QSearchQSearch

CVE-2018-25425

8.2 HIGH

Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting...

Published: 2026-05-30 · Last updated: 2026-06-01

Severity and scoring

CVSS
8.2 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE
CWE-89

Description

Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid and cid parameters. Attackers can send GET requests to index.php with crafted SQL payloads in the aid or cid parameters to extract database information including table and column names.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-52700 — Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions (8.5 HIGH)
  • CVE-2026-52697 — Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions (8.5 HIGH)
  • CVE-2026-52693 — Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions (9.3 CRITICAL)
  • CVE-2026-49776 — Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 vers... (9.3 CRITICAL)
  • CVE-2026-49067 — Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions (9.3 CRITICAL)