{"cve":"CVE-2015-9098","nvd":{"published":"2017-06-22T19:29:00.197","modified":"2026-06-17T00:35:48.300","status":"Modified","description":"In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-89"],"references":["http://www.red-gate.com/products/dba/sql-monitor/entrypage/security-vulnerability","https://www.exploit-db.com/exploits/42444/","http://www.red-gate.com/products/dba/sql-monitor/entrypage/security-vulnerability","https://www.exploit-db.com/exploits/42444/"],"products":["red-gate:sql_monitor"],"source":"nvd","synced_at":"2026-10-19T20:43:44.556243339+00:00"},"epss":{"cve":"CVE-2015-9098","score":0.14074,"percentile":0.96564,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}