PT-2025-35937 · Go-Cms · Go-Cms

Kamil Szczurowski + 1 · Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-7385

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GOV CMS versions prior to 4.0

Description The input from the search query parameter in GOV CMS is not properly sanitized, leading to a Blind SQL injection. This could be exploited by an unauthenticated remote attacker.

Recommendations Ensure proper sanitization of input from the search query parameter.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-7385

Affected Products

Go-Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-7385 · Security Note
• https://twitter.com/CVEnew/status/1963602770692592016 · Twitter Post
• https://cert.pl/posts/2025/09/CVE-2025-7385 · Note
• https://t.me/CVEtracker/31697 · Telegram Post
• https://sam3.pl/strona-305-za_co_nas_cenia_redaktorzy.html · Note