CVE-2018-25176CWE-352

Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload

High · published March 6, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the key parameter in the search endpoint. Attackers can also upload arbitrary files via the person photo upload functionality to the images/uploaded directory for remote code execution.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00208 · 10.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-03-06T12:19Z
EPSS history
Timeline
  • 06 MAR 12:19Z
    Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload
    cvelistv5