Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00987 · Published 2026-07-14 · Fixed in 13.0.6500.1, 13.0.7095.1 +8 CWE-89
Priority MEDIUM 42
External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-07-14 · Fixed in 13.0.6500.1, 13.0.7095.1 +8 CWE-73
Priority MEDIUM 46
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01532 · Published 2026-07-14 · Fixed in 13.0.6500.1, 13.0.7095.1 +8 CWE-502
Priority MEDIUM 46
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01532 · Published 2026-07-14 · Fixed in 17.0.4060.2, 17.0.1125.2 CWE-502
Priority LOW 36
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00691 · Published 2026-07-14 · Fixed in 13.0.6500.1, 13.0.7095.1 +8 CWE-89
Priority MEDIUM 41
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00555 · Published 2026-05-12 · Fixed in 13.0.6490.1, 13.0.7085.1 +8 CWE-73
Priority LOW 36
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0025 · Published 2026-04-14 · Fixed in 13.0.6485.1, 13.0.7080.1 +11 CWE-89
Priority MEDIUM 41
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00706 · Published 2026-04-14 · Fixed in 16.0.1175.1 CWE-822
Priority LOW 36
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00299 · Published 2026-04-14 · Fixed in 13.0.6485.1, 13.0.7080.1 +8 CWE-89
Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01187 · Published 2026-03-10 · Fixed in 17.0.4020.2, 17.0.1105.2 CWE-89
Priority MEDIUM 43
Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0125 · Published 2026-03-10 · Fixed in 13.0.6480.4, 13.0.7075.5 +8 CWE-1287
Priority MEDIUM 43
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01661 · Published 2026-03-10 · Fixed in 13.0.6480.4, 13.0.7075.5 +8 CWE-284
Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01177 · Published 2025-11-11 · Fixed in 13.0.6475.1, 13.0.7070.1 +6 CWE-89
Priority MEDIUM 43
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01419 · Published 2025-09-09 · Fixed in 13.0.6470.1, 13.0.7065.1 +6 CWE-77
Priority LOW 30
Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00869 · Published 2025-09-09 · Fixed in 13.0.6470.1, 13.0.7065.1 +6 CWE-200
Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01209 · Published 2025-08-12 · Fixed in 13.0.6465.1, 13.0.7060.1 +6 CWE-89
Priority MEDIUM 44
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01765 · Published 2025-08-12 · Fixed in 13.0.6465.1, 13.0.7060.1 +6 CWE-284
Priority MEDIUM 43
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01261 · Published 2025-08-12 · Fixed in 13.0.6465.1, 13.0.7060.1 +6 CWE-89
Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01007 · Published 2025-08-12 · Fixed in 13.0.6465.1, 13.0.7060.1 +6 CWE-269
Priority MEDIUM 55
Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15498 · Published 2025-07-08 · Fixed in 13.0.6460.7, 13.0.7055.9 +6 CWE-20
Priority LOW 37
Microsoft SQL Server Remote Code Execution Vulnerability
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00769 · Published 2024-11-12 · Fixed in 14.0.2070.1, 15.0.2130.3 +6 CWE-416
Priority MEDIUM 43
SQL Server Native Client Remote Code Execution Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01631 · Published 2024-11-12 · Fixed in 14.0.2070.1, 15.0.2130.3 +4 CWE-197
Priority MEDIUM 43
SQL Server Native Client Remote Code Execution Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01458 · Published 2024-11-12 · Fixed in 14.0.2070.1, 15.0.2130.3 +4 CWE-122
Priority MEDIUM 43
SQL Server Native Client Remote Code Execution Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01458 · Published 2024-11-12 · Fixed in 14.0.2070.1, 15.0.2130.3 +4 CWE-416
Priority MEDIUM 43
SQL Server Native Client Remote Code Execution Vulnerability
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01458 · Published 2024-11-12 · Fixed in 15.0.4410.1, 14.0.2070.1 +4 CWE-122
Load more
THREATIST.IORead the docs