CVE-2025-1185

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModal_Sensor_Graph. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
pihome-shc	PiHome	2.0

References

https://github.com/janssensjelle/published-pocs/blob/main/pihomehva_sqli_ajax.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.295089Permissions Required, VDB Entry
https://vuldb.com/?id.295089Third Party Advisory, VDB Entry
https://vuldb.com/?submit.495548Third Party Advisory, VDB Entry

Timeline

Published: Feb 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-118504.3When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasse CVE-2025-118513.5A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /set_alias.cgi. Such man CVE-2025-118525.3A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of th CVE-2025-118538.1A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endp CVE-2025-118557.5The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing CVE-2025-118566.4The Eventbee Ticketing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventbeeticketwidget' shortcode in CVE-2025-118576.4The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxp_fb2wp_display_embed' shortcode in CVE-2025-118596.4The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions u CVE-2025-11869.8A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the CVE-2025-118606.4The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to,CVE-2025-118628.4A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the A CVE-2025-118636.4The My Geo Posts Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mygeo_city' shortcode in all versions up to