PT-2026-23682 · Undefined · Undefined

Published 2026-03-06 · Updated 2026-03-06 · CVE-2018-25170

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id, idC, and idU parameters. Attackers can send GET requests to the lesson.php endpoint with malicious SQL payloads to extract sensitive database information.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-25170

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-25170 · Security Note
• https://exploit-db.com/exploits/45858 · Note
• https://vulncheck.com/advisories/docebolms-sql-injection-via-lessonphp · Note