CVE-2025-56401 identifies an SQL Injection vulnerability in ZIRA Group WBRM version 7.0 within the referenceLookupsByTableNameAndColumnName functionality. The vulnerability permits an attacker with network access and low privileges to inject malicious SQL commands, potentially leading to high confidentiality impact, limited integrity impact, and limited availability impact. The CVSS v3.1 base score is 7.6, reflecting the severity and exploitability of the issue. There is no information about available patches or fixes, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation could allow an attacker to access or disclose sensitive data (high confidentiality impact), cause limited unauthorized modification of data (low integrity impact), and cause limited disruption to system availability (low availability impact). The vulnerability requires low privileges and no user interaction, increasing the risk in exposed environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable interface to untrusted networks.