CVE-2025-10712CWE-74CWE-89sql-injection

CVE-2025-10712

High · published September 19, 2025

CVSS v3.1

7.3

EPSS

Percentile

32.6

In the wild

Unconfirmed

What it is

A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v3.1: 7.3 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00396 · 32.6th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-09-19T18:15Z

References (5)

https://github.com/1276486/CVE/issues/13 · [email protected]https://vuldb.com/?ctiid.325000 · [email protected]https://vuldb.com/?id.325000 · [email protected]https://vuldb.com/?submit.644970 · [email protected]https://github.com/1276486/CVE/issues/13 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 SEP 13:32Z
07FLYCMS/07FLY-CMS/07FlyCRM login sql injection
cvelistv5