PT-2025-6107 · Pix · Pix Software Vivaz

Stux · Published 2025-02-10 · Updated 2025-02-10 · CVE-2025-1156

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Pix Software Vivaz version 6.0.10

Description: A critical issue has been found in the code related to the /servlet?act=login file, where manipulation of the usuario argument can lead to SQL injection. This issue can be exploited remotely. The vendor was contacted about the disclosure but did not respond.

Recommendations: For Pix Software Vivaz version 6.0.10, consider disabling the /servlet?act=login endpoint or restricting access to it until a patch is available. Additionally, avoid using the usuario argument in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-1156

Affected Products

Pix Software Vivaz

References · 7

• 🔥 https://vuldb.com/?submit.493482 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1156 · Security Note
• https://twitter.com/CVEnew/status/1889052406027325610 · Twitter Post
• https://vuldb.com/?ctiid.295060 · Note
• https://vuldb.com/?id.295060 · Note
• https://t.me/latest_high_impact_cve/1810 · Telegram Post
• https://t.me/cvedetector/17601 · Telegram Post