---
id: CVE-2025-55703
title: >-
  An error-based SQL injection vulnerability exists in the Sunbird Power IQ
  9.2.0 API
summary: >-
  An error-based SQL injection vulnerability exists in the Sunbird Power IQ
  9.2.0 API. The vulnerability is due to an outdated API endpoint that applied
  arrays without proper input validation. This can allow attackers to manipulate
  SQL que…
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N'
cwe:
  - CWE-89
vendor: sunbirddcim
product: power_iq
affected:
  - power_iq = 9.2.0
published: '2025-12-15'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:10:00.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-55703'
references:
  - url: 'https://pastebin.com/C6hVPpF4'
    label: cve@mitre.org
  - url: 'https://www.sunbirddcim.com/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00142
epssPercentile: 0.03101
ingestedAt: '2026-10-14T16:40:32.049Z'
---

## Overview

An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays without proper input validation. This can allow attackers to manipulate SQL queries. This has been addressed in Power IQ version 9.2.1, where the API call code was updated to ensure safe handling of input values.

## Affected

- `power_iq = 9.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.