CVE-2018-25196CWE-89sql-injection

CVE-2018-25196

High · published March 6, 2026

CVSS v3.1

8.2

EPSS

Percentile

20.3

In the wild

Unconfirmed

What it is

ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to reset.php with malicious email values containing SQL operators to bypass authentication and extract sensitive database information.

The record

Technical detail

CVSS v3.1: 8.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00289 · 20.3th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-03-06T18:16Z

References (2)

https://www.exploit-db.com/exploits/45817 · [email protected]https://www.vulncheck.com/advisories/serverzilla-sql-injection-via-email-parameter · [email protected]

EPSS history

Timeline

06 MAR 12:19Z
ServerZilla 1.0 SQL Injection via email Parameter
cvelistv5