SQL Injection in Commvault
CVE-2025-34136
An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.
Vulnerability class: SQL Injection
EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.
Affected products
- Commvault — versions 11.32.0, 11.36.0, 11.38.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory, patch)
- disclosure@vulncheck.com (third-party-advisory)