CVE-2026-25076

HIGH

7.3

Descripcion

Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQL instructions resulting in modifications to the data contained in the Anchore Enterprise database.

Detalles CVE

Puntuacion CVSS v3.17.3

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Vector de ataqueADJACENT_NETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/13/2026

Ultima modificacion3/16/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-89

Referencias

https://anchore.com/platform/(disclosure@vulncheck.com)

https://docs.anchore.com/current/docs/release_notes/enterprise/5251/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/anchore-enterprise-graphql-reports-api-sql-injection(disclosure@vulncheck.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.