CVE-2025-57792

{"id": "CVE-2025-57792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57792", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-28T18:33:37.822537Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "mandiant-cve@google.com", "affectedData": [{"vendor": "Explorance", "product": "Blue", "versions": [{"status": "affected", "version": "0", "lessThan": "8.14.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-28T18:16:49.463", "references": [{"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0001.md", "tags": ["Third Party Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)", "tags": ["Vendor Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57792", "tags": ["Vendor Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://www.explorance.com/products/blue", "tags": ["Product"], "source": "mandiant-cve@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "mandiant-cve@google.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk."}, {"lang": "es", "value": "Versiones de Explorance Blue anteriores a la 8.14.9 contienen una vulnerabilidad de inyecci\u00f3n SQL causada por la validaci\u00f3n insuficiente de la entrada del usuario en un endpoint de aplicaci\u00f3n web. Un atacante puede proporcionar una entrada manipulada que se ejecuta como parte de las consultas de base de datos de backend. El problema es explotable sin autenticaci\u00f3n, lo que aumenta significativamente el riesgo."}], "lastModified": "2026-06-17T09:43:26.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:explorance:blue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2AB6583-0303-48FA-B066-9CF5941EFE28", "versionEndExcluding": "8.14.9"}], "operator": "OR"}]}], "sourceIdentifier": "mandiant-cve@google.com"}