{"id":"CVE-2025-0966","title":"IBM InfoSphere Information Server SQL injection","summary":"IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvssSource":"cna","cwe":["CWE-89"],"vendor":"IBM","product":"InfoSphere Information Server","affected":["infosphere_information_server 11.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-06-26T03:55:21.202377Z"},"published":"2025-06-25","updated":"2026-11-04","sourceUpdated":"2026-11-04T00:12:29.505Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-0966","references":[{"url":"https://www.ibm.com/support/pages/node/7236613"}],"tags":["cve.org"],"epss":0.0033,"epssPercentile":0.26344,"ingestedAt":"2026-11-05T20:33:06.648Z","slug":"CVE-2025-0966","body":"## Overview\n\nIBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.\n\n## Affected\n\n- `infosphere_information_server 11.7`\n\n## Remediation\n\nInfoSphere Information Server, InfoSphere Information Server on Cloud  11.7.0.0 to 11.7.1.6  DT422417  --Apply InfoSphere Information Server version 11.7.1.0 \n--Apply InfoSphere Information Server version 11.7.1.6\n\n--Apply InfoSphere DataStage security patch\n--For InfoSphere DataStage Flow Designer, a security patch will be published subsequently.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}