PT-2025-46453 · Microsoft · Sql Server

Published 2025-11-11 · Updated 2026-03-07 · CVE-2025-59499

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SQL Server (affected versions not specified)

Description The software contains an SQL injection issue due to improper neutralization of special elements used in SQL commands. This allows an authorized attacker to elevate privileges over a network by manipulating input data within SQL queries. The issue occurs when user input is not correctly validated or sanitized before being incorporated into SQL queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-14157

CVE-2025-59499

Affected Products

Sql Server

References · 17

• https://osv.dev/vulnerability/CVE-2025-59499 · Vendor Advisory
• https://bdu.fstec.ru/vul/CVE-2025-59499 · Security Note
• https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59499 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59499 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-59499 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14157 · Security Note
• https://twitter.com/VaultEdgeIT/status/1989385454118928858 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59499 · Note
• https://twitter.com/CveFindCom/status/1988331475213648176 · Twitter Post
• https://t.me/avleonovcom/1606 · Telegram Post
• https://twitter.com/CVEnew/status/1988348995136012302 · Twitter Post
• https://t.me/cveNotify/143079 · Telegram Post
• https://twitter.com/CveTodo/status/1988315879138791630 · Twitter Post
• https://t.me/cveNotify/142454 · Telegram Post