CVE-2021-25899

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform...

Basic Information

CVE State: PUBLISHED
Reserved Date: January 22, 2021
Published Date: April 23, 2021
Last Updated: August 03, 2024
Vendor: n/a
Product: n/a
Description: An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.

CVSS Scores

EPSS Score

Score: 85.35% (Percentile: 99.29%) as of 2025-04-29

Exploit Status

Exploited in the Wild: Yes (added 2025-04-28 00:00:00 UTC) Source

References

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/

Known Exploited Vulnerability Information

Source	Added Date
The Shadowserver (via CIRCL)	2025-04-28 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25899.yaml	2025-04-26 00:00:00 UTC