PT-2026-28241 · Wecodex · Library Cms

Published 2026-03-26 · Updated 2026-03-26 · CVE-2018-25204

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Library CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can send POST requests to the admin login endpoint with boolean-based blind SQL injection payloads in the username field to manipulate database queries and gain unauthorized access.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25204

Affected Products

Library Cms

References · 4

• 🔥 https://exploit-db.com/exploits/44728 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-25204 · Security Note
• https://vulncheck.com/advisories/library-cms-sql-injection-via-admin-login · Note
• https://wecodex.com/item/view/library-management-system-in-php-and-mysql/1 · Note