CVE-2025-10870CWE-89sql-injection
CVE-2025-10870
published November 7, 2025
What it is
SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the 'ultralogin' parameter in '/centrosnet/ultralogin.php'.
The record
Technical detail
- CVSS
- 9.3 · NONE
- CVSS v4.0
- Not supplied
- EPSS
- 0.00290 · 20.4th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2025-11-07T15:15Z
References (1)
EPSS history
Timeline