CVE-2025-25181: medium-severity vulnerability in Advantive VeraCore
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in VeraCore's timeoutWarning.asp page lets attackers insert malicious SQL commands through the PmSess1 parameter, potentially accessing or modifying sensitive database information.
SQL injection vulnerability in timeoutWarning.asp parameter PmSess1 allows unauthenticated remote attackers to execute arbitrary SQL queries against the backend database. The vulnerability stems from insufficient input validation on user-supplied parameters, enabling data exfiltration, modification, or deletion depending on database permissions.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.