VULNERABILITY INTELLIGENCE
CVE-2025-34136
EPSS probability0.53%
CISA KEVNot currently listed
Published2025-07-25
Last modified2026-06-17
Description
An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.
Weakness classification
- disclosure@vulncheck.com: CWE-89