{"id":"CVE-2026-25606","state":"PUBLISHED","title":"SQL Injection in STER","description":"A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any\nother data that the application itself is able to access\n\nThis issue was fixed in version 9.5.","publishedAt":"2026-05-22T09:14:40.513Z","updatedAt":"2026-05-22T13:45:12.067Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy STER"],"affected":[{"vendor":"Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy","product":"STER","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.5","versionType":"semver"}]}],"references":["https://cert.pl/posts/2026/05/CVE-2026-25606","https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/25xxx/CVE-2026-25606.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-25606","state":"PUBLISHED","datePublished":"2026-05-22T09:14:40.513Z","dateUpdated":"2026-05-22T13:45:12.067Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-02-03T13:12:14.138Z"},"containers":{"cna":{"title":"SQL Injection in STER","descriptions":[{"lang":"en","value":"A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any\nother data that the application itself is able to access\n\nThis issue was fixed in version 9.5."}],"affected":[{"vendor":"Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy","product":"STER","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.5","versionType":"semver"}]}],"references":[{"url":"https://cert.pl/posts/2026/05/CVE-2026-25606","tags":["third-party-advisory"]},{"url":"https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-05-22T09:14:40.513Z"},"credits":[{"lang":"en","type":"finder","value":"Michelin CERT"}],"datePublic":"2026-05-22T12:19:00.000Z","impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-22T13:44:32.907219Z","id":"CVE-2026-25606","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-22T13:45:12.067Z"}}]}}}