CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection

CriticalCVSS 9.4

Published: 2026-11-06 02:05
Updated: 2026-11-10 15:59
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Affected products

Product	Affected versions	Fixed in
Subnet Solutions PowerSYSTEM Center 2024	>= 6.0.x, <= 6.2.x	No fix listed
Subnet Solutions PowerSYSTEM Center 2026	>= 7.0.x, <= 7.1.x	No fix listed

References

CVSS v4.0

9.4 Critical

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Adjacent
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

All scores (2)

v4.0 9.4 · icscert
v3.1 9.0 · icscert

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-89

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.