CVE-2025-14254
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Risk Assessment
The risk is that an authenticated attacker can read sensitive data from the database, potentially leading to data confidentiality breaches.
Recommendation
Upgrade Vitals ESP to a patched version and implement input validation and parameterized queries.
Other vulnerabilities in Vitals ESP
See all- CVE-2025-14255Medium
Vitals ESP by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-14253Medium
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
Original NVD description (English source)
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS