CVE-2018-25199CWE-89

OOP CMS BLOG 1.0 SQL Injection via search parameter

High · published March 6, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through multiple parameters. Attackers can inject SQL commands via the search parameter in search.php, pageid parameter in page.php, and id parameter in posts.php to extract database information including table names, schema names, and database credentials.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-06T12:19Z
EPSS history
Timeline
  • 06 MAR 12:19Z
    OOP CMS BLOG 1.0 SQL Injection via search parameter
    cvelistv5