CVE-2025-57792

Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0001.md	Third Party Advisory
https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)	Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57792	Vendor Advisory
https://www.explorance.com/products/blue	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:explorance:blue:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-28 18:16

Updated : 2026-06-17 09:43

NVD link : CVE-2025-57792

Mitre link : CVE-2025-57792

CVE.ORG link : CVE-2025-57792

JSON object : View

Products Affected

explorance

blue

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-57792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57792", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-28T18:33:37.822537Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "mandiant-cve@google.com", "affectedData": [{"vendor": "Explorance", "product": "Blue", "versions": [{"status": "affected", "version": "0", "lessThan": "8.14.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-28T18:16:49.463", "references": [{"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0001.md", "tags": ["Third Party Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)", "tags": ["Vendor Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57792", "tags": ["Vendor Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://www.explorance.com/products/blue", "tags": ["Product"], "source": "mandiant-cve@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "mandiant-cve@google.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk."}, {"lang": "es", "value": "Versiones de Explorance Blue anteriores a la 8.14.9 contienen una vulnerabilidad de inyecci\u00f3n SQL causada por la validaci\u00f3n insuficiente de la entrada del usuario en un endpoint de aplicaci\u00f3n web. Un atacante puede proporcionar una entrada manipulada que se ejecuta como parte de las consultas de base de datos de backend. El problema es explotable sin autenticaci\u00f3n, lo que aumenta significativamente el riesgo."}], "lastModified": "2026-06-17T09:43:26.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:explorance:blue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2AB6583-0303-48FA-B066-9CF5941EFE28", "versionEndExcluding": "8.14.9"}], "operator": "OR"}]}], "sourceIdentifier": "mandiant-cve@google.com"}