QwikSec

Security Database

CVE

CWE

Training

CVE-2025-34240

Published: Nov 6, 2025

Modified: Nov 17, 2025

PUBLISHED

Description

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

Vendor	Product	Versions
Advantech	WebAccess/VPN	affected `0 - < 1.1.5`

Weaknesses (CWE)

References

https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf

vendor-advisory

patch

https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-appmanagementcontroller-appupgradeaction

third-party-advisory

https://icr.advantech.com/download/software

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.