CVE-2025-1184

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
pihome-shc	PiHome	1.77

References

https://github.com/janssensjelle/published-pocs/blob/main/pihome_sqli_ajax.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.295088Permissions Required, VDB Entry
https://vuldb.com/?id.295088Third Party Advisory, VDB Entry
https://vuldb.com/?submit.495413Third Party Advisory, VDB Entry

Timeline

Published: Feb 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-118405.5A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulat CVE-2025-118416.4The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attr CVE-2025-118426.3A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bun CVE-2025-118438.8Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vuln CVE-2025-118445.4Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagent CVE-2025-118454.9A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(CVE-2025-118464.9A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9 CVE-2025-118474.9A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 CVE-2025-118484.9A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 CVE-2025-118499.3Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of th CVE-2025-11858.8A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?A CVE-2025-118504.3When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasse