CVE-2025-26794

Published Feb 21, 2025·Updated Jun 17, 2026

NVD Description

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Public Exploits & PoCs2 found

PoC: CVE-2025-26794-exploit

SQL injection exploit for CVE-2025-26794 in Exim 4.98. Automated data extraction via time-based blind SQLi. For authorized penetration testing only.

PoC: CVE-2025-26794

CVE-2025-26794: SQLite (DBM) injection in Exim 4.98 - exploit writeup

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free