Advantech WISE-IoTSuite/SaaS - SQL Injection

Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the filename parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code such as the use of pgsleep for time delays to...

CVE-2025-52694-POC

CVE-2025-52694: Advantech SaaS Composer SQL Injection This repository contains Proof-of-Concept PoC tools for CVE-2025-52694 , a critical unauthenticated SQL Injection vulnerability affecting Advantech IoTSuite and IoT Edge Products. Vulnerability Overview Attribute| Details ---|--- CVE ID|...

Advantech多款产品 SQL注入漏洞

Advantech IoTSuite SaaSComposer is a product of Advantech Corporation from Taiwan, China. Advantech IoTSuite SaaSComposer is a low-code visual development tool. Advantech IoTSuite Growth Linux docker is a containerized deployment solution for industrial IoT platforms. Advantech IoTSuite Starter...

📄 Advantech IoTSuite / IoT Edge SQL Injection

A critical unauthenticated SQL injection vulnerability was identified in Advantech WISE-IoTSuite / SaaS Composer. The issue resides in the /displays/filename.json endpoint, where the filename parameter is improperly sanitized before being concatenated into a backend PostgreSQL query. An attacker...