Vulnerability · Published Sep 9, 2025 · Assigned by VulDB
CVE-2025-10121uverif kami_list addbatch sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in uverif. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 76.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in uverif up to 3.2. This affects the function addbatch of the file /admin/kami_list. This manipulation of the argument note causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Affected products (as reported)
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-323090 | uverif kami_list addbatch sql injection vdb-entry, technical-description
- VDB-323090 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #645685 | uverif CMS 2.0 SQL Injection third-party-advisory
- https://github.com/Axianke/cve_bug/issues/1 exploit, issue-tracking