← CVE Intelligence

CVE-2025-27240

Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host PUBLISHED

Description (CNA)

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

Affected (CNA)

Vendor / productVersions
Zabbix / Zabbixaffected 6.0.0 through 6.0.33; affected 6.4.0 through 6.4.18; affected 7.0.0 through 7.0.3

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.