PT-2026-4818 · Structure · Structure

Published 2026-01-26 · Updated 2026-02-13 · CVE-2025-59473

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Structure for Admin (affected versions not specified)

Description A SQL Injection issue exists in the Structure for Admin authenticated user. The issue allows an attacker with admin access to enumerate or manipulate database records. This is due to missing parameterization and input validation, resulting in user input being included in SQL queries without proper sanitization. The vulnerability was discovered during testing of an admin dashboard, where SQL payloads injected into a parameter caused database error responses, enabling the extraction of sensitive information such as user emails and settings. The vulnerable parameter is not explicitly specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-59473

Affected Products

Structure

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-59473 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59473 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1r01b8s/top_10_trending_cves_09022026 · Reddit Post
• https://twitter.com/viehgroup/status/2020011579945931064 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1qz67mk/top_10_trending_cves_08022026 · Reddit Post
• https://hackerone.com/reports/3249794 · Note
• https://twitter.com/CVEnew/status/2015907306605879563 · Twitter Post
• https://t.me/cveNotify/151929 · Telegram Post