CVE-2025-22953

critical · 9.8

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution.

9.8

CVSS

1.8%

EPSS (exploit prob.)

78th

EPSS percentile

2025-03-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
epicor	human_capital_management	2021_1.9

Check a specific version with /api/v1/cve/match.

References

https://github.com/maliktawfiq/CVE-2025-22953
https://tinted-hollyhock-92d.notion.site/EPICOR-HCM-Unauthenticated-Blind-SQL-Injection-CVE-2025-22953-170f1fdee211803988d1c9255a8cb904?pvs=4
https://www.epiusers.help/t/alert-hcm-security-patch/124777

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-22953