CVE-2025-25181

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-25181
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

5.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://advantive.my.site.com/support/s/knowledge Product Release Notes
https://intezer.com/blog/research/xe-group-exploiting-zero-days/ Exploit Technical Description Third Party Advisory
https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/ Exploit Technical Description Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25181
Configurations

Configuration 1 (hide)

cpe:2.3:a:advantive:veracore:*:*:*:*:*:*:*:*
History

21 Oct 2025, 23:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25181 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25181', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25181 -

13 Mar 2025, 14:31

Type Values Removed Values Added
CPE cpe:2.3:a:advantive:veracore:*:*:*:*:*:*:*:*
References () https://advantive.my.site.com/support/s/knowledge - () https://advantive.my.site.com/support/s/knowledge - Product, Release Notes
References () https://intezer.com/blog/research/xe-group-exploiting-zero-days/ - () https://intezer.com/blog/research/xe-group-exploiting-zero-days/ - Exploit, Technical Description, Third Party Advisory
References () https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/ - () https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/ - Exploit, Technical Description, Third Party Advisory
First Time Advantive
Advantive veracore

06 Feb 2025, 18:15

Type Values Removed Values Added
References
  • () https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/ -

04 Feb 2025, 16:15

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de inyección SQL en timeoutWarning.asp en Advantive VeraCore hasta 2025.1.0 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro PmSess1.

03 Feb 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-03 20:15

Updated : 2025-10-21 23:16

NVD link : CVE-2025-25181

Mitre link : CVE-2025-25181

CVE.ORG link : CVE-2025-25181

JSON object : View

Products Affected

advantive

  • veracore
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')