CVE-2018-25404: The Open ISES Project 3.30A SQL Injection via add_facnote.php

Security readout for executives and security teams

Open ISES Project 3.30A has an unauthenticated SQL injection issue. A reachable vulnerable instance could let an attacker query backend database contents, including sensitive operational data. The sources do not identify active exploitation, but they do cite a public exploit reference, which increases urgency for exposed deployments. Exposure is limited to organizations running Open ISES Project 3.30A. Risk is highest where the application is reachable from the internet or broadly accessible internal networks. The bundle does not list affected CPEs or other versions. Prioritize discovery and containment for any reachable Open ISES Project 3.30A instance. The business concern is potential database disclosure without credentials. If the product is unused or unsupported, retirement may be lower risk than waiting for unclear remediation guidance. Mitigation focus: Identify and inventory all Open ISES Project deployments and versions.; Remove internet exposure until vendor guidance or a safe replacement is confirmed.; Check the official project and advisory sources for any fixed release or vendor mitigation..

Prepared

Jun 3, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.