CVE-2025-1185 MEDIUM

CVE-2025-1185: pihome-shc PiHome ajax.php sql injection

Vendor Pihome-Shc

Product PiHome

Weakness CWE-89 · SQLi

Published February 12, 2025

Last update February 18, 2025

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModal_Sensor_Graph. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

February 12, 2025 CVE published

February 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-1185 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-47334 WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability CVE-2026-7083 likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injection CVE-2025-13270 Campcodes School Fees Payment Management System ajax.php sql injection CVE-2023-49639 Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) CVE-2024-7119 MD-MAFUJUL-HASAN Online-Payroll-Management-System employee_viewmore.php sql injection