CVE-2025-27378 - CVE House
Back to Database
Status published High CVE-2025-27378

SQL Injection in AES Due to Inactive SQL Parsing Configuration

Vulnerability Description

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27378

Credits & Attribution

No credits recorded in the NVD database.

References

More from Altium

View All →
CVE-2025-27380
HTML Injection Leading to Script Execution in Altium Enterprise Server
High 7.6
CVE-2025-27379
Stored Cross-Site Scripting in AES BOM Viewer
Medium 6.8
CVE-2025-27377
Missing Validation of Self-Signed Certificates in Altium Designer Allows Man-in-the-Middle Attacks
Medium 5.3

Affected Vendor

Affected Software

AES
Vulnerable Versions:
7.0.3

Timeline

Official Publish: January 22nd, 2026
Last Modified: January 22nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-89 CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact