CVE-2025-34246

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Nov 6, 2025

CISA due date

—

The record

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

Affected packages

Ecosystem	Package	Introduced	Fixed