What’s Vulnerable › Vulnerabilities

CVE-2021-25899

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-23 · updated 2026-06-17
• Weakness: CWE-89

Description

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.

Affected products

• Void Aurall Rec Monitor: 9.0.0.1

References

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765

Get alerted when CVE-2021-25899 or the next vulnerability affects your stack