CVE-2025-22217

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products.

A malicious user with network access may be able to use specially crafted SQL queries to gain database access.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-222187.7VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be CVE-2025-222199.0VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges m CVE-2025-22227.8CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privi CVE-2025-222205.4VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and netw CVE-2025-222214.8VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria CVE-2025-222226.5VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit thi CVE-2025-222235.3Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an auth CVE-2025-222248.2VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious ac CVE-2025-222258.2VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary ker CVE-2025-222266.0VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor CVE-2025-222276.1In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client CVE-2025-222287.4BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first