CVE-2025-11188
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Kiwire Captive Portal contains a blind SQL injection vulnerability in the nas-id parameter, allowing SQL commands to be issued and compromising the corresponding database.
Risk Assessment
An attacker can manipulate the database, potentially leading to confidentiality, integrity, and availability breaches, as well as takeover of the portal.
Recommendation
Fix the vulnerability by validating and sanitizing the nas-id parameter and using prepared statements. Contact the vendor for a patch.
Other vulnerabilities in Kiwire Captive Portal
See all- CVE-2025-11190Medium
The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
- CVE-2025-11189High
Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability in the login-url parameter, allowing JavaScript execution.
Original NVD description (English source)
The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS