CVE-2025-10115CWE-74CWE-89sql-injection

CVE-2025-10115

High · published September 9, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name/userName causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.6th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-09-09T05:15Z
References (4)
https://github.com/drew-byte/SiempreCMS-SQLi-POC · [email protected]https://vuldb.com/?ctiid.323084 · [email protected]https://vuldb.com/?id.323084 · [email protected]https://vuldb.com/?submit.645531 · [email protected]
EPSS history
Timeline
  • 09 SEP 00:32Z
    SiempreCMS user_search_ajax.php sql injection
    cvelistv5