CVE-2025-27378

SQL Injection in AES Due to Inactive SQL Parsing Configuration

State: Published
Severity: 8.6 High
Published: Jan 22, 2026
Updated: Jan 22, 2026
Reserved: Feb 23, 2025

Description

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	Altium

Weaknesses

CWE-89 SQL Injection
CWE-20 Improper Input Validation

Affected Products

Product	Versions
AESAltium	7.0.3 through 7.0.5Affectedfrom 7.0.6Not affected

References

https://www.altium.com/platform/security-compliance/security-advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.