{"id":"CVE-2025-58780","aliases":["EUVD-2025-26996","GHSA-cfrp-33c4-m9hw"],"status":"disputed","title":"index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.","description":"index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it \"inaccurately describes the vulnerability.\"","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00231,"percentile":0.14074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2025-09-05T00:00:00Z","modified":"2026-06-17T09:44:55Z","exploits":[{"source":"pocgithub","id":"SexyShoelessGodofWar/CVE-2025-58780","title":"SexyShoelessGodofWar/CVE-2025-58780","date":"2025-09-05","url":"https://github.com/SexyShoelessGodofWar/CVE-2025-58780"}],"products":[{"vendor":"sciencelogic","product":"sl1"}],"references":[{"url":"https://docs.sciencelogic.com/release_notes_html/Content/12-1-1/12-1-1_release_notes.htm#New_Features_in_12-1-1"},{"url":"https://github.com/SexyShoelessGodofWar/CVE-2025-58780"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58780"},{"url":"https://github.com/advisories/GHSA-cfrp-33c4-m9hw"}],"sources":{"cve":[{"id":"CVE-2025-58780","description":"index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it \"inaccurately describes the vulnerability.\"","status":"disputed","published":"2025-09-05T00:00:00Z","modified":"2025-09-08T20:44:05.246Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:37.027582Z"}],"euvd":[{"id":"EUVD-2025-26996","description":"index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it \"inaccurately describes the vulnerability.\"","status":"published","published":"2025-09-05T00:00:00Z","modified":"2025-09-08T20:44:05Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T20:31:46.000077Z"}],"ghsa":[{"id":"GHSA-cfrp-33c4-m9hw","title":"index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.","description":"index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.","status":"published","published":"2025-09-05T15:31:10Z","modified":"2025-09-05T15:31:22Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:03:29.995439Z"}],"nvd":[{"id":"CVE-2025-58780","description":"index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it \"inaccurately describes the vulnerability.\"","status":"disputed","published":"2025-09-05T15:15:33.02Z","modified":"2026-06-17T09:44:55.233Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:27.73916Z"}]}}