CVE-2025-57515

Critical

Published: 06 October 2025

Published

06 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0041 61.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-57515 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-57515 is a SQL injection vulnerability (CWE-89) affecting Uniclare Student Portal v2, published on 2025-10-06T18:15:51.663. The flaw enables remote attackers to inject arbitrary SQL commands through vulnerable input fields, particularly by executing time-delay functions to infer database responses.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows high-impact compromise of confidentiality, integrity, and availability, such as through time-based blind SQL injection to extract sensitive data or manipulate database operations.

Advisories and additional details, including potential mitigation steps, are documented in the referenced sources: the GitHub repository at https://github.com/sanchitsahni/CVE-2025-57515/ and the PDF report at https://github.com/sanchitsahni/CVE-2025-57515/blob/main/Uniclare%20Student%20Portal%20v2.pdf.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-32132

Vulnerability details

A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnerable input fields, enabling the execution of time-delay functions to infer database responses.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

T1190 directly matches exploitation of a public-facing web application via unauthenticated SQL injection. T1213.006 is facilitated by the ability to inject SQL for extracting sensitive database information.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0