CVE-2025-58780: 
ScienceLogic SL1 Agent vulnerability analysis and mitigation

A SQL injection vulnerability was identified in ScienceLogic SL1's index.em7 file before version 12.1.1. The vulnerability allows SQL Injection via a parameter in a request. However, this vulnerability is disputed by the Supplier because it "inaccurately describes the vulnerability." The issue was discovered and reported in 2023, with public disclosure on September 5, 2025 (MITRE, GitHub).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). It received a CVSS v3.1 base score of 7.2 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. This indicates the vulnerability is network accessible, requires low attack complexity, needs no privileges or user interaction, and can affect resources beyond the security scope of the affected component (MITRE).

The vulnerability could potentially allow attackers to manipulate database requests and gain unauthorized access to sensitive data or control over the database. The CVSS score indicates low confidentiality and integrity impact, with no availability impact (GitHub).

The vulnerability is exploitable remotely and requires low attack complexity with no authentication needed. However, there are no public reports of this vulnerability being exploited in the wild (MITRE).

The vulnerability has been fixed in ScienceLogic SL1 version 12.1.1. Users are advised to upgrade to this version or later to mitigate the vulnerability (ScienceLogic Docs).