CVE-2018-25399-nvd.nist.gov-Deferred

The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou…

Published:

28 May 2026 at 22:00:00

Alert date:

29 May 2026 at 17:11:09

Source:

nvd.nist.gov

Web Technologies, Database & Storage

The Open ISES Project version 3.30A contains a critical SQL injection vulnerability in the nearby.php file. Unauthenticated attackers can exploit this flaw by injecting malicious SQL code through the tick_lat and tick_lng parameters via GET requests. This vulnerability allows attackers to execute arbitrary SQL queries and extract sensitive database information including usernames, database names, and version details. The vulnerability has been assigned CVE-2018-25399 and affects the open source ISES project available on SourceForge.

Technical details

Mitigation steps:

Affected products:

Open ISES Project