CVE-2025-15498CWE-89

SQL Injection in Pro3W CMS

Critical · published February 27, 2026

CVSS v4.0

9.3

EPSS

Percentile

45.4

In the wild

Unconfirmed

What it is

Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges.

This issue was identified in version 1.2.0 of this software. Due to lack of response from the vendor exact version range could not be determined, but the vulnerability should be eliminated in versions released in January 2026 and later.

The record

Technical detail

CVSS v4.0: 9.3 · CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00553 · 45.4th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-02-27T13:51Z

EPSS history

Timeline

27 FEB 13:51Z
SQL Injection in Pro3W CMS
cvelistv5