CVE-2025-10351CWE-89sql-injection

CVE-2025-10351

published October 8, 2025

CVSS
9.3
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-08T15:15Z
References (2)
https://github.com/ivansmc00/CVE-2025-10351-POC · [email protected]https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform · [email protected]
EPSS history
Timeline
  • 08 OCT 10:45Z
    SQL injection vulnerability in Melis Platform
    cvelistv5