Critical severity · published Jan 28, 2026
CVE-2025-57792
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint
10.0
CVSS
0.4%
EPSS
No
On KEV
Description
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Blue · Explorance
before 8.14.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57792
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57792
Third Party Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0001.md
Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)
Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57792
Product
https://www.explorance.com/products/blue
More from Blue
9.9
CVE-2025-57795
Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component
9.1
CVE-2025-57794
Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface
8.6
CVE-2025-57793
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application component
6.8
CVE-2025-57796
Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system…
6.1
CVE-2025-52344
Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the…