CVE-2025-53639 - CVE House
Back to Database
Status published Medium CVE-2025-53639

Metersphere has SQL Injection Vulnerability in Sorting Field

Vulnerability Description

MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53639

Credits & Attribution

No credits recorded in the NVD database.

References

More from metersphere

View All →
CVE-2025-62604
MeterSphere logic flaw allows retrieval of arbitrary user information
Medium 5.3
CVE-2024-37161
MeterSphere front-end editor stores XSS vulnerability
Medium 4
CVE-2024-36118
Unauthorized viewing of workspace test cases in MeterSphere
Low 3.5
CVE-2024-32467
Meteraphsere vulnerable to unauthorized viewing by workspace members
Medium 5.7
CVE-2023-50267
MeterSphere horizontal privilege escalation vulnerability of resources in project scope.
Medium 4.3

Affected Vendor

metersphere

View all reports →

Affected Software

metersphere
Vulnerable Versions:
< 3.6.5-lts

Timeline

Official Publish: July 14th, 2025
Last Modified: July 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact