CVE-2025-12462CWE-89
Blind SQL Injection in DobryCMS
Critical · published March 2, 2026
What it is
A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple parameters resulting in Blind SQL Injection.
This issue was fixed in versions above 8.0.
The record
Technical detail
- CVSS v4.0
- 9.3 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00476 · 40.1th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2026-03-02T12:49Z
EPSS history
Timeline