{"id":"CVE-2026-125612","aliases":["EUVD-2026-120748","GHSA-vh32-wwf2-h629"],"status":"published","title":"DIAEnergie - SQL Injection Vulnerability","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00239,"percentile":0.1511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-11-10T02:59:53Z","modified":"2026-11-10T03:30:39Z","products":[{"vendor":"delta electronics","product":"diaenergie"},{"vendor":"deltaww","product":"diaenergie"}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00017_DIAEnergie%20SQL%20Injection%20Vulnerability_v1.0.pdf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125612"},{"url":"https://github.com/advisories/GHSA-vh32-wwf2-h629"}],"sources":{"cve":[{"id":"CVE-2026-125612","title":"DIAEnergie - SQL Injection Vulnerability","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032.","status":"published","published":"2026-11-10T02:59:53.843Z","modified":"2026-11-10T19:34:19.589Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T04:36:56.913427Z"}],"euvd":[{"id":"EUVD-2026-120748","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032.","status":"published","published":"2026-11-10T02:59:53Z","modified":"2026-11-10T19:34:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T05:19:59.129782Z"}],"ghsa":[{"id":"GHSA-vh32-wwf2-h629","title":"Improper neutralization of special elements used in an SQL command ('SQL injection')...","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032.","status":"published","published":"2026-11-10T03:30:35Z","modified":"2026-11-10T03:30:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T03:51:51.547106Z"}],"nvd":[{"id":"CVE-2026-125612","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032.","status":"published","published":"2026-11-10T03:16:42.547Z","modified":"2026-11-12T20:07:11.09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T07:18:24.254872Z"}]}}