Vulnerability · Published Jan 13, 2026 · Assigned by ProgressSoftware
CVE-2025-13774SQL injection leading to privilege escalation in Progress Flowmon ADS
High 8.8
In plain English
A high-severity SQL injection in Flowmon ADS from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Flowmon ADS | Flowmon ADS 12 versions prior to 12.5.4Flowmon ADS 13 versions prior to 13.0.1 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H