SQL Injection vulnerability in the Structure for Admin authenticated user

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Expressionengine
  • Expressionengine

No data.

No data.

References
Link Providers
https://www.spirityenterprise.com/pentest spirity
https://hackerone.com/reports/3249794 cve-icon cve-icon
History

Tue, 27 Jan 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Expressionengine
Expressionengine expressionengine
Vendors & Products Expressionengine
Expressionengine expressionengine

Mon, 26 Jan 2026 22:00:00 +0000

Type Values Removed Values Added
Description SQL Injection vulnerability in the Structure for Admin authenticated user
References
Metrics cvssV3_0

{'score': 6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L'}
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-01-26T21:43:05.071Z

Reserved: 2025-09-16T15:00:07.876Z

Link: CVE-2025-59473

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-01-26T22:15:53.157

Modified: 2026-01-26T22:15:53.157

Link: CVE-2025-59473

cve-icon Redhat

No data.