Actively exploited in the wild

Advantive VeraCore SQL Injection Vulnerability

Advantive - VeraCore · Listed in the CISA KEV since 2025-03-10. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-25181

MediumCVSS 5.8KEV

Published: 03/02/2025(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

Risk Assessment

An attacker could execute arbitrary SQL commands, potentially leading to unauthorized database access, data modification, or theft.

Recommendation

Update Advantive VeraCore to the latest version and apply secure coding practices to prevent SQL injection.

Other vulnerabilities in Advantive VeraCore

CVE-2024-57968CriticalActively exploited
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones accessible during web browsing by other users). upload.aspx can be used for this.

Original NVD description (English source)

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.