What is the CVSS score of CVE-2025-25181?

CVE-2025-25181 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 72.1%.

Which versions of Veracore are affected by CVE-2025-25181?

Organizations using timeoutWarning.asp in Advantive VeraCore should be aware of moderate risk from CVE-2025-25181, a SQL injection vulnerability rated CVSS 5.8.

Is there a public PoC exploit available for CVE-2025-25181?

Yes, a public proof-of-concept exploit is available for CVE-2025-25181. Prioritise patching immediately. EPSS: 72.1%.

How to fix or mitigate CVE-2025-25181?

Within 24 hours: Identify affected systems running timeoutWarning.asp in Advantive VeraCore and apply vendor patches immediately. Validate input sanitization for user-controlled parameters.

Veracore CVE-2025-25181

MEDIUM

SQL Injection (CWE-89)

2025-02-03 cve@mitre.org

SQLi Veracore

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:07 vuln.today

Added to CISA KEV

Nov 05, 2025 - 19:28 cisa

CISA KEV

PoC Detected

Nov 05, 2025 - 19:28 vuln.today

Public exploit code

CVE Published

Feb 03, 2025 - 20:15 nvd

MEDIUM 5.8

DescriptionCVE.org

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

AnalysisAI

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter. Affected products include: Advantive Veracore. Version information: through 2025.1.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.