CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2025-25181
High (7.5) in Advantive VeraCore. In CISA KEV since 2025-03-10. EPSS 56% chance of exploitation in the next 30 days.
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
Severity
- EPSS
- 56% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-03-10, due 2025-03-31
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- advantive:veracore
References
- https://advantive.my.site.com/support/s/knowledge
- https://intezer.com/blog/research/xe-group-exploiting-zero-days/
- https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25181