CVE-2025-40628CWE-89
SQL Injection in DomainsPRO
Critical · published May 13, 2025
What it is
SQL injection vulnerability in DomainsPRO 1.2. This vulnerability could allow an attacker to retrieve, create, update and delete databases via the “d” parameter in the “/article.php” endpoint.
The record
Technical detail
- CVSS v4.0
- 9.3 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00355 · 28.0th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2025-05-13T09:37Z
EPSS history
Timeline