CVE-2025-25181

Description

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

Reserved 2025-02-03 | Published 2025-02-03 | Updated 2025-03-14 | Assigner mitre

CISA Known Exploited Vulnerability

Date added 2025-03-10 | Due date 2025-03-31

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

Any version
affected

References

advantive.my.site.com/support/s/knowledge

intezer.com/blog/research/xe-group-exploiting-zero-days/

www.solissecurity.com/...d-skimming-to-exploiting-zero-days/

cve.org (CVE-2025-25181)

nvd.nist.gov (CVE-2025-25181)

Download JSON