CVE-2025-10068CWE-74CWE-89sql-injection

CVE-2025-10068

High · published September 7, 2025

CVSS v3.1

7.3

EPSS

Percentile

36.8

In the wild

Unconfirmed

What it is

A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 7.3 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00436 · 36.8th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-09-07T09:15Z

Affected products (1)

Product	Versions	Fixed in
emiloi/online_discussion_forum	all versions	—

References (5)

https://github.com/JunGu-W/cve/issues/13 · [email protected]https://itsourcecode.com/ · [email protected]https://vuldb.com/?ctiid.322991 · [email protected]https://vuldb.com/?id.322991 · [email protected]https://vuldb.com/?submit.644077 · [email protected]

EPSS history

Timeline

07 SEP 04:32Z
itsourcecode Online Discussion Forum add_views.php sql injection
cvelistv5