CVE-2025-66944

CriticalPublic PoC

Published: 04 March 2026

Published

04 March 2026

Modified

09 March 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0077 50.8th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-66944 is a critical-severity SQL Injection (CWE-89) vulnerability in Databasir Databasir. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-66944 is a SQL injection vulnerability (CWE-89) in vran-dev/databasir versions 1.0.7 and prior. The flaw resides in the search API endpoint, where a remote attacker can inject malicious SQL via the query parameter, leading to arbitrary code execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

A remote, unauthenticated attacker can exploit this vulnerability by crafting and submitting a malicious query parameter to the affected search API endpoint. Successful exploitation enables arbitrary code execution on the server, potentially resulting in full compromise with high impacts on confidentiality, integrity, and availability, such as data exfiltration, modification, or denial of service.

Mitigation details are available in related advisories, including the GitHub issue at https://github.com/vran-dev/databasir/issues/283 and the analysis at https://zeroday.endlessparadox.com/posts/cve-2025-66944/. Security practitioners should consult these for patching instructions and workarounds specific to databasir deployments.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-208283

Vulnerability details

SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search API endpoint

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in unauthenticated public-facing search API endpoint enables remote arbitrary code execution, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0