Skip to content
OpenAdvisories
High ICSA-25-191-08 10 CVEs

Advantech iView

Published Jul 10, 2025 · Updated Jul 10, 2025

Vendor: Advantech Product: iView

Summary

Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, achieve remote code execution, or cause service disruptions.

Vulnerabilities 10

  • High 8.8
    CVE-2025-52577

    Advantech iView SQL Injection

    A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not p…

    Advantech iView
  • High 8.8
    CVE-2025-53475

    Advantech iView SQL Injection

    A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this func…

    Advantech iView
  • High 8.8
    CVE-2025-53515

    Advantech iView SQL Injection

    A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitiz…

    Advantech iView
  • High 7.6
    CVE-2025-48891

    Advantech iView SQL Injection

    A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be exploited by an authenticated attacker with at least user-level privileges, potentially leading to informat…

    Advantech iView
  • Medium 6.5
    CVE-2025-52459

    Advantech iView Argument Injection

    A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters can be used directly in a command without pr…

    Advantech iView
  • Medium 6.5
    CVE-2025-53509

    Advantech iView Argument Injection

    A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command witho…

    Advantech iView
  • Medium 5.4
    CVE-2025-41442

    Advantech iView Cross-site Scripting

    A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, pot…

    Advantech iView
  • Medium 5.4
    CVE-2025-53397

    Advantech iView Cross-site Scripting

    A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting this flaw, an attacker could execute unauthorized scripts in the user's browser, potentially leading …

    Advantech iView
  • Medium 5.4
    CVE-2025-53519

    Advantech iView Cross-site Scripting

    A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating specific parameters, an attacker could execute unauthorized scripts in the user's browser, potentia…

    Advantech iView
  • Medium 4.3
    CVE-2025-46704

    Advantech iView Path Traversal

    A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanit…

    Advantech iView

Revision history

  1. #1

    Initial Publication

References