{"id":"CVE-2025-40887","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-40887","generatedAt":"2026-10-27T23:55:40.328Z","title":"A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter.","description":"A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.","published":"2025-10-07T13:15:35.000Z","lastModified":"2026-10-18T21:10:00.000Z","status":"Analyzed","sourceIdentifier":"prodsec@nozominetworks.com","cvss":{"version":"4.0","score":6,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-89"],"affected":["nozominetworks/cmc","nozominetworks/guardian"],"epss":{"score":0.00239,"percentile":0.14889,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://security.nozominetworks.com/NN-2025:8-01","tags":["Vendor Advisory"],"source":"prodsec@nozominetworks.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-40887","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}