CVE-2025-55703

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-55703

2.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

A

n error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays without proper input validation. This can allow attackers to manipulate SQL queries. This has been addressed in Power IQ version 9.2.1, where the API call code was updated to ensure safe handling of input values.

References
Link Resource
https://pastebin.com/C6hVPpF4 Third Party Advisory
https://www.sunbirddcim.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:sunbirddcim:power_iq:9.2.0:*:*:*:*:*:*:*
History

30 Dec 2025, 20:28

Type Values Removed Values Added
CPE cpe:2.3:a:sunbirddcim:power_iq:9.2.0:*:*:*:*:*:*:*
References () https://pastebin.com/C6hVPpF4 - () https://pastebin.com/C6hVPpF4 - Third Party Advisory
References () https://www.sunbirddcim.com/ - () https://www.sunbirddcim.com/ - Product
First Time Sunbirddcim power Iq
Sunbirddcim

16 Dec 2025, 14:10

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-15 20:15

Updated : 2025-12-30 20:28

NVD link : CVE-2025-55703

Mitre link : CVE-2025-55703

CVE.ORG link : CVE-2025-55703

JSON object : View

Products Affected

sunbirddcim

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')