ScienceLogic vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited ScienceLogic flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2024-9537 ScienceLogic SL1 UnspecifiedExploited since Oct 21, 2024 · CVSS 9.3

Latest high and critical flaws

• CVE-2025-58780 index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.High 7.2 · Sep 5, 2025
• CVE-2024-9537 ScienceLogic SL1 UnspecifiedExploited · Critical 9.3 · Oct 18, 2024
• CVE-2022-48604 A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directlyHigh 8.8 · Aug 9, 2023
• CVE-2022-48603 A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dHigh 8.8 · Aug 9, 2023
• CVE-2022-48602 A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it diHigh 8.8 · Aug 9, 2023
• CVE-2022-48601 A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it diHigh 8.8 · Aug 9, 2023
• CVE-2022-48600 A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to High 8.8 · Aug 9, 2023
• CVE-2022-48599 A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it diHigh 8.8 · Aug 9, 2023
• CVE-2022-48598 A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes High 8.8 · Aug 9, 2023
• CVE-2022-48597 A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dirHigh 8.8 · Aug 9, 2023
• CVE-2022-48596 A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dHigh 8.8 · Aug 9, 2023
• CVE-2022-48595 A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes iHigh 8.8 · Aug 9, 2023
• CVE-2022-48594 A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dHigh 8.8 · Aug 9, 2023
• CVE-2022-48593 A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dHigh 8.8 · Aug 9, 2023
• CVE-2022-48592 A SQL injection vulnerability exists in the vendor_country parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐coHigh 8.8 · Aug 9, 2023
• CVE-2022-48591 A SQL injection vulnerability exists in the vendor_state parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐contHigh 8.8 · Aug 9, 2023
• CVE-2022-48590 A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passHigh 8.8 · Aug 9, 2023
• CVE-2022-48589 A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it diHigh 8.8 · Aug 9, 2023
• CVE-2022-48588 A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes High 8.8 · Aug 9, 2023
• CVE-2022-48587 A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directlHigh 8.8 · Aug 9, 2023
• CVE-2022-48586 A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly toHigh 8.8 · Aug 9, 2023
• CVE-2022-48585 A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it direHigh 8.8 · Aug 9, 2023
• CVE-2022-48584 A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and pasHigh 8.8 · Aug 9, 2023
• CVE-2022-48583 A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dHigh 8.8 · Aug 9, 2023
• CVE-2022-48582 A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes iHigh 8.8 · Aug 9, 2023