Priority MEDIUM 43
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01419 · Published 2025-09-09 · Fixed in 13.0.6470.1, 13.0.7065.1 +6 CWE-77
Priority LOW 30
Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00869 · Published 2025-09-09 · Fixed in 13.0.6470.1, 13.0.7065.1 +6 CWE-200
