PT-2026-23705 · Unknown · Serverzilla

Published 2026-03-06 · Updated 2026-03-06 · CVE-2018-25196

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ServerZilla version 1.0

Description ServerZilla version 1.0 contains an SQL injection issue that allows unauthenticated attackers to manipulate database queries. Attackers can send POST requests to the ''reset.php'' endpoint with malicious values in the email parameter, containing SQL operators. This allows them to bypass authentication and extract sensitive database information.

Recommendations Apply a fix to sanitize the email parameter in the ''reset.php'' endpoint to prevent SQL injection.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25196

Affected Products

Serverzilla

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25196 · Security Note
• https://t.me/CVEtracker/46610 · Telegram Post
• https://vulncheck.com/advisories/serverzilla-sql-injection-via-email-parameter · Note
• https://exploit-db.com/exploits/45817 · Note