CVE-2025-34136

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed...

CVE-2025-34136 Commvault CommServe Web Server Unauthenticated SQL Injection

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed...

CVE-2025-34136 Commvault CommServe Web Server Unauthenticated SQL Injection

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed...

CVE-2025-34136

The CVE-2025-34136 entry affects Commvault's Web Server component on systems where CommServe and Web Server roles are installed. A SQL injection vulnerability exists in the Web Server, with affected versions: 11.32.0–11.32.93, 11.36.0–11.36.51, and 11.38.0–11.38.19. An unauthenticated remote atta...

PT-2025-30886 · Commvault · Commvault

Name of the Vulnerable Software and Affected Versions: Commvault versions 11.20.0 through 11.20.0 Commvault versions 11.28.0 through 11.28.0 Commvault versions 11.32.0 through 11.32.0 Commvault versions 11.34.0 through 11.34.0 Commvault versions 11.36.0 through 11.36.0 Description: A DLL injectio...

PT-2025-30885 · Commvault · Commvault

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This ma...

Commvault for Windows 安全漏洞

Commvault for Windows is a data backup, recovery software from Commvault Inc. in the United States. A security vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0, which stems from an elevation of privilege that could lead to unauthorized access...

Commvault for Windows 安全漏洞

Commvault for Windows is a data backup, recovery software from Commvault, Inc. A security vulnerability exists in Commvault for Windows that originates from a DLL injection and could lead to arbitrary code execution. The following versions are affected: version 11.20.0, version 11.28.0, version...

PT-2025-30892 · Commvault · Commvault

Name of the Vulnerable Software and Affected Versions: Commvault versions 11.32.0 through 11.32.93 Commvault versions 11.36.0 through 11.36.51 Commvault versions 11.38.0 through 11.38.19 Description: An SQL injection vulnerability exists in the Web Server component that could allow a remote,...

Commvault 安全漏洞

Commvault is a data backup and recovery software from Commvault Corporation in the United States. A security vulnerability exists in Commvault versions 11.32.0 through 11.32.93, 11.36.0 through 11.36.51, and 11.38.0 through 11.38.19, which originates from a SQL injection vulnerability in the Web...

CVE-2024-13976: Uncontrolled Search Path Element

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated...

CVE-2025-34136: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed...

CVE-2024-13975: Improper Privilege Management

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This ma...

CISA Warns of Suspected Broader SaaS Attacks Exploiting App Secrets and Cloud Misconfigs

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday revealed that Commvault is monitoring cyber threat activity targeting applications hosted in their Microsoft Azure cloud environment. "Threat actors may have accessed client secrets for Commvault's Metallic Microsoft 365...

CVE-2021-34996

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2021-34997

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2021-34995

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2021-34993

This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CVSearchService service. The issue results from the lack of proper...

CVE-2021-34994

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider...

CVE-2020-25780

In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file outside of the log-files folder...