CVE-2025-59397
published 2025-09-15CVE-2025-59397: Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection.
PriorityP434medium5CVSS 3.1
AVNACLPRLUINSCCLINAN
EPSS
0.39%
30.3th percentile
Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| open-web-analytics | open-web-analytics | >= 0 < 1.8.1 | 1.8.1 |
| openwebanalytics | open_web_analytics | < 1.8.1 | 1.8.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Open Web Analytics Server is vulnerable to SQL Injection
ghsa·2025-09-15
CVE-2025-59397 [MEDIUM] CWE-89 Open Web Analytics Server is vulnerable to SQL Injection
Open Web Analytics Server is vulnerable to SQL Injection
Open Web Analytics (OWA) before 1.8.1 allows SQL injection.
OSV
Open Web Analytics Server is vulnerable to SQL Injection
osv·2025-09-15
CVE-2025-59397 [MEDIUM] Open Web Analytics Server is vulnerable to SQL Injection
Open Web Analytics Server is vulnerable to SQL Injection
Open Web Analytics (OWA) before 1.8.1 allows SQL injection.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/1e5531522acb8f145627c9feb0175cf8a66561bahttps://github.com/Open-Web-Analytics/Open-Web-Analytics/compare/1.8.0...1.8.1https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.8.1https://seclists.org/fulldisclosure/2025/Oct/5https://www.openwebanalytics.comhttps://www.seralys.com/research/CVE-2025-59397.txthttp://seclists.org/fulldisclosure/2025/Oct/5https://seclists.org/fulldisclosure/2025/Oct/5
2025-09-15
Published