This vulnerability in Tenable Nessus involves improper neutralization of special elements used in an SQL command, enabling SQL injection. Specifically, an attacker controlling reverse DNS records of a scanned host can inject malicious SQL into the scan results database. The vulnerability is remotely exploitable without authentication and has a CVSS 3.1 base score of 5.3 (medium severity). The vendor has released an official fix to remediate the issue.

Successful exploitation allows an unauthenticated remote attacker to inject SQL commands via reverse DNS records, potentially leading to unauthorized disclosure of scan-result data stored in the Nessus database. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

An official fix is available from Tenable to address this vulnerability. Users should apply the vendor-provided patch promptly to remediate the SQL injection issue. Since this is not a cloud service, remediation depends on user action to update Nessus installations.