{"id":"CVE-2025-55472","aliases":["EUVD-2025-26417","GHSA-28xf-239h-cqjm"],"status":"published","title":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API...","description":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0037,"percentile":0.31377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2025-09-02T00:00:00Z","modified":"2026-11-07T18:10:00Z","products":[{"vendor":"tirreno","product":"tirreno"}],"references":[{"url":"https://github.com/tirrenotechnologies/tirreno","tags":["Product","package"]},{"url":"https://github.com/tirrenotechnologies/tirreno/releases/tag/v0.9.6","tags":["Release Notes","web"]},{"url":"https://cyberducky.medium.com/blind-sql-injection-found-in-tirreno-security-analytics-cbd791cec1c0","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55472","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-28xf-239h-cqjm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55472.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-55472","description":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.","status":"published","published":"2025-09-02T00:00:00Z","modified":"2025-09-02T19:49:38.327Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-26417","description":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.","status":"published","published":"2025-09-02T00:00:00Z","modified":"2025-09-02T19:49:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:48.3448Z"}],"ghsa":[{"id":"GHSA-28xf-239h-cqjm","title":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API...","description":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.","status":"published","published":"2025-09-02T21:30:58Z","modified":"2025-09-02T21:31:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:03:28.374084Z"}],"nvd":[{"id":"CVE-2025-55472","description":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.","status":"published","published":"2025-09-02T17:15:35.95Z","modified":"2026-11-07T18:10:00.2Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-07T20:06:28.095135Z"}],"osv":[{"id":"CVE-2025-55472","description":"SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.","status":"published","published":"2025-09-02T00:00:00Z","modified":"2026-11-09T02:31:05.172192945Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-09T03:16:44.651171Z"}]}}