SQL Injection in STER
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any other data that the application itself is able to access This issue was fixed in version 9.5.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy | STER | before 9.5 | 9.5 | Patch available | CNA |
- STER VendorCentralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy Affected before 9.5 Fixed in 9.5 Patch available CNA
Remediation
- Fix · CNA STER (Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy) Fixed in 9.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy STER 9.5
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-20714 Weak password encoding in STERPriority LOW 24
- TI-2026-20715 Lack of traffic encryption in STERPriority LOW 11
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25606
- 2026-10-03 Alias added: GHSA-6vwp-cg8j-vqgh
- 2026-10-25 Priority changed: MEDIUM → LOW
References
More Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy vulnerabilities
- TI-2026-20714 Weak password encoding in STER CVSS 4.0MEDIUM 5.7
- TI-2026-20715 Lack of traffic encryption in STER CVSS 4.0LOW 2.3
Sources
- CVE-2026-25606 · CVE Program
- CVE-2026-25606 · NVD
- FIRST EPSS
- GHSA-6vwp-cg8j-vqgh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences