SQL Injection in Sicommnet Basec
CVE-2025-22371
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)
Vulnerability class: SQL Injection
EPSS: 0.006 (43.6th percentile) — read the EPSS interpretation.
Affected products
- Sicommnet Basec — versions 14 Dec 2021, 16 April 2025 23:00 EST
Weakness classification (CWE)
Public proof-of-concept exploits
References
- csirt@divd.nl (product)
- csirt@divd.nl (third-party-advisory)
- csirt@divd.nl (third-party-advisory)
Frequently asked questions
- What is CVE-2025-22371?
- CVE-2025-22371 is a vulnerability in Sicommnet Basec, classified under SQL Injection. Published 2025-04-14.
- Is CVE-2025-22371 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.