PT-2026-5855 · Davidvg+1 · 60Cyclecms

Unkn0Wn · Published 2026-02-03 · Updated 2026-02-18 · CVE-2020-37110

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 60CycleCMS version 2.5.2

Description The software contains an SQL injection issue in the 'news.php' and 'common/lib.php' files. Attackers can manipulate database queries through unvalidated user input. Specifically, the 'title' parameter is vulnerable to malicious SQL code injection, potentially allowing attackers to extract or modify database contents. This issue does not involve cross-site scripting.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user-supplied input to the 'title' parameter before using it in database queries.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-37110

Affected Products

60Cyclecms

References · 6

• 🔥 https://exploit-db.com/exploits/48177 · Exploit
• https://osv.dev/vulnerability/CVE-2020-37110 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37110 · Security Note
• https://vulncheck.com/advisories/cyclecms-newsphp-sql-injection-vulnerability · Note
• https://t.me/cveNotify/152400 · Telegram Post
• https://opensourcecms.com/60cyclecms · Note