An authenticated user can exploit an SQL injection flaw in Tenable Nessus to read or alter data stored by the application, potentially exposing sensitive information or corrupting inventory records.

Tenable Nessus is the affected product; the CVE entry does not specify exact impacted versions, but the vendor’s advisory recommends updating to Nessus 10.12.5 or later.

The CVSS base score of 8.7 indicates a high severity vulnerability. Because the flaw requires authentication, the risk is limited to users who have valid Nessus credentials; however, once compromised, the attacker can modify critical data. The EPSS score is 0.00378, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed yet, but the high CVSS score recommends prompt remediation.