CVE-2025-8296

HIGH

7.2

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-08-12

Last Modified2026-06-17

Data SourcesNVD

Vulnerability Description

SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution

Affected Platforms (CPE)

📦

Ivanti

Avalanche

< 6.4.8.8008

References & Advisories

🔗 https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-CVE-2025-8296-CVE-2025-8297?language=en_US

相关漏洞威胁

CVE-2025-82977.2

Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with ...

CVE-2023-380369.8

A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a bu...

CVE-2024-131817.3

Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CV...

CVE-2024-131807.5

Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. Th...