CVE-2025-22953

Summary

CVE-2025-22953 is a SQL injection vulnerability affecting Epicor HCM 2021 versions 1.9. This issue lies in the filter parameter of the JsonFetcher.svc endpoint, allowing an attacker to inject malicious SQL payloads. The exploitation of this vulnerability may result in unauthorized execution of arbitrary SQL commands, potentially leading to remote code execution if certain database features, such as xp_cmdshell, are enabled. Patches to mitigate this risk are available for HCM2022, HCM2023, and HCM2024, with versions 5.16.0.1033, 5.17.0.1146, and 5.18.0.573 respectively.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.