CVE-2025-27240

HIGH

Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-27240 has a selected CVSS score of 7.5 (high).

Description

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 13, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zabbix

Browse Zabbix / Zabbix

Default status: unknown

CVE List6.0.0 to ≤ 6.0.33affected
6.4.0 to ≤ 6.4.18affected
7.0.0 to ≤ 7.0.3affected

References

2