Vulnerability · Published Jun 26, 2025 · Assigned by OpenNMS
CVE-2025-53122SQLi in OpenNMS Horizon and Meridian
Medium 6.9
In plain English
A medium-severity SQL injection in Horizon from The OpenNMS Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Injection. Users should upgrade to Meridian 2024.2.6 or newer, or Horizon 33.16 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The OpenNMS Group | Horizon | 25.2.1 – before 33.1.6, 33.1.733.0.8 – before 33.1.6, 33.1.7 |
| The OpenNMS Group | Meridian | 2024.1.0 – before 2024.2.6, 2024.2.7 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N