CVE-2026-25606
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SQL injection vulnerability in STER allows an authenticated attacker to inject SQL via search filters, potentially reading sensitive data of other users or other application data.
Risk Assessment
Risk includes data breach and potential privilege escalation.
Recommendation
Upgrade STER to version 9.5 or later.
Other vulnerabilities in STER
See all- CVE-2026-25608Low
Vulnerability in STER prior to version 9.5. The application uses unencrypted TCP traffic to transmit data, enabling Man-In-The-Middle attacks and interception of sensitive data such as passwords or authentication tokens.
- CVE-2026-25607Medium
STER software uses a weak password encoding algorithm, allowing the password value to be guessed after analyzing how known passwords are encoded. The issue was fixed in version 9.5.
Original NVD description (English source)
A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any other data that the application itself is able to access This issue was fixed in version 9.5.