SQL Injection Vulnerability in AES from Altium
CVE-2025-27378

8.6HIGH

Key Information:

Vendor

Altium

Status
Aes
Vendor
CVE Published:
22 January 2026

What is CVE-2025-27378?

The AES product from Altium is susceptible to a SQL injection vulnerability stemming from a disabled configuration that fails to activate the latest SQL parsing logic. This misconfiguration permits attackers to inject malicious SQL queries, potentially compromising the integrity and confidentiality of the database. Proper application of the SQL parsing logic is crucial to mitigate this risk and ensure robust security.

Affected Version(s)

AES Web 7.0.3 <= 7.0.5

References

https://www.altium.com/platform/security-compliance/secur...

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.