CVE-2025-14255
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vitals ESP by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Risk Assessment
Authenticated attackers can read the entire database contents, potentially leading to leakage of confidential information. The organization may suffer severe reputational and financial losses.
Recommendation
It is recommended to apply vendor patches and implement input validation and parameterized queries. Also restrict user privileges.
Other vulnerabilities in Vitals ESP
See all- CVE-2025-14254Medium
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-14253Medium
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
Original NVD description (English source)
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS