CVE-2025-25181

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 10, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-251829.4Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2CVE-2025-251832.6vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash coCVE-2025-251846.5Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be CVE-2025-251857.5GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for softCVE-2025-251866.5Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0CVE-2025-251875.4Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulCVE-2025-251885.7Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3CVE-2025-251895.5The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web ProcessiCVE-2025-25196.5The Sreamit theme for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 4.0.1. This is due to insuffCVE-2025-251905.5The ZOO-Project is an open source processing platform. The ZOO-Project Web Processing Service (WPS) Server contains a Cross-Site Scripting (CVE-2025-251915.4Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properlCVE-2025-251926.5GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access se