CVE-2025-22953
Last modified
CVE-2025-22953 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. EPSS estimates a 1.41% chance of exploitation in the next 30 days.
Description
A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Epicor | Human Capital Management | 2021_1.9 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-22953?
How severe is CVE-2025-22953?
How do I fix CVE-2025-22953?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-22940Incorrect access control in Adtran 411 ONT L80.00.0011.M2 al…9.1
- CVE-2025-22941A command injection vulnerability in the web interface of Ad…9.8
- CVE-2025-22946Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overfl…9.8
- CVE-2025-22949Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to comman…9.8
- CVE-2025-2295EDK2 contains a vulnerability in BIOS where a user may cause…3.5
- CVE-2025-22952elestio memos v0.23.0 is vulnerable to Server-Side Request F…9.8
- CVE-2025-22954GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11…10
- CVE-2025-22956OPSI before 4.3 allows any client to retrieve any ProductPro…9.8
- CVE-2025-22957A SQL injection vulnerability exists in the front-end of the…9.8
- CVE-2025-2296EDK2 contains a vulnerability in BIOS where an attacker may …8.4
- CVE-2025-22960A session hijacking vulnerability exists in the web-based ma…8
- CVE-2025-22961A critical information disclosure vulnerability exists in th…8
Are you affected by CVE-2025-22953?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST