Vulnerability Details CVE-2025-8296
SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.1%
CVSS Severity
CVSS v3 Score 7.2
Products affected by CVE-2025-8296
-
cpe:2.3:a:ivanti:avalanche:-
-
cpe:2.3:a:ivanti:avalanche:6.0
-
cpe:2.3:a:ivanti:avalanche:6.1.103.53
-
cpe:2.3:a:ivanti:avalanche:6.1.106.337
-
cpe:2.3:a:ivanti:avalanche:6.1.106.496
-
cpe:2.3:a:ivanti:avalanche:6.2.0
-
cpe:2.3:a:ivanti:avalanche:6.2.0.602
-
cpe:2.3:a:ivanti:avalanche:6.2.2
-
cpe:2.3:a:ivanti:avalanche:6.2.2.197
-
cpe:2.3:a:ivanti:avalanche:6.3.1
-
cpe:2.3:a:ivanti:avalanche:6.3.1.1507
-
cpe:2.3:a:ivanti:avalanche:6.3.2
-
cpe:2.3:a:ivanti:avalanche:6.3.2.3490
-
cpe:2.3:a:ivanti:avalanche:6.3.3
-
cpe:2.3:a:ivanti:avalanche:6.3.3.101
-
cpe:2.3:a:ivanti:avalanche:6.3.4
-
cpe:2.3:a:ivanti:avalanche:6.3.4.153
-
cpe:2.3:a:ivanti:avalanche:6.4.1
-
cpe:2.3:a:ivanti:avalanche:6.4.1.207
-
cpe:2.3:a:ivanti:avalanche:6.4.1.236
-
cpe:2.3:a:ivanti:avalanche:6.4.2
-
cpe:2.3:a:ivanti:avalanche:6.4.5
-
cpe:2.3:a:ivanti:avalanche:6.4.6