CVE-2025-10460 Unsanitized parameter input leading to SQL Injection vulnerability
Unauthenticated attackers can execute arbitrary SQL commands via unsanitized input in the legacy BEIMS Contractor Web application, exposing sensitive database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10460?
CVE-2025-10460 is a critical SQL injection vulnerability in BEIMS Contractor Web, published on 17 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input validation on /BEIMSWeb/contractor.asp endpoint and successful exploitation requires a contractor.asp endpoint open to the internet. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity and potentially the availability of the database.
Version 5.7.139
has been confirmed as vulnerable. Other versions have not been confirmed by the vendor and users should assume that all versions of BEIMS Contractor Web may be impacted until further guidance is provided by the vendor.
Weakness: CWE-20
Which versions are affected by CVE-2025-10460?
How do I fix CVE-2025-10460?
No fix has been published for CVE-2025-10460 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-10460 being exploited?
There is no known exploitation of CVE-2025-10460 in the wild and no public exploit code.
Sources
Also known as GHSA-5fjw-vh88-cccm.