CVE-2025-40886
HIGHNozomi Networks CMC and Guardian < 25.2.0 - Authenticated SQL Injection via Alert Input Parameter
Title source: llmDescription
A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized data, altering their structure and content, and/or affecting their availability.
References (1)
Core 1
Core References
Vendor Advisory
https://security.nozominetworks.com/NN-2025:7-01
Scores
CVSS v3
7.5
EPSS
0.0024
EPSS Percentile
15.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (2)
nozominetworks/cmc
< 25.2.0
nozominetworks/guardian
< 25.2.0
Published
Oct 07, 2025
Tracked Since
Feb 18, 2026