Melis Platform CVE-2025-10351
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Melis CMS endpoint
-
DeliveryCraft malicious idPage parameter
-
ExploitInject SQL via getTinyTemplates
-
ExecutionRead/modify/delete database records
-
ImpactFull data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration conditions beyond deployment - the vulnerable code path is the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint of the melis-cms module, exploitable by any attacker who can reach that endpoint over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, requires no authentication and no user interaction against a running Melis Platform instance. The practical limiting factor is network reachability of the Melis CMS administrative endpoint: instances behind authentication gateways, IP allow-lists, or not exposed to untrusted networks are not reachable by remote attackers, and the overall exposure is bounded by the product's small install base. |
| Impact | This is a genuinely high-priority flaw whose signals are largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated injection with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), scoring 9.3 - appropriate for a CWE-89 SQL injection that permits read, create, update, and delete operations on the backing database. A working proof-of-concept is publicly available (ivansmc00/CVE-2025-10351-POC), which lowers the barrier to exploitation. The one tempering signal is EPSS: 0.41% (33rd percentile) is low, which is typical for a niche product that is unlikely to be mass-scanned, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation in the wild. Net assessment: the technical severity and exploitability are high and the POC makes exploitation trivial for anyone who reaches an exposed instance, but real-world blast radius is constrained by the product's limited deployment footprint rather than by any defensive property of the vulnerability itself. Treat as urgent for any organization actually running Melis Platform, lower urgency fleet-wide given low prevalence. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint with a malicious SQL payload in the 'idPage' parameter, injecting into the backend query to read, modify, or destroy arbitrary database contents. Because a public POC exists and the CVSS vector indicates network vector with low complexity and no privileges or user interaction, exploitation requires only reachability of the Melis CMS endpoint and no valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated SQL injection in the melis-cms module of Melis Platform lets remote attackers execute arbitrary SQL through the 'idPage' parameter of the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint, enabling full read, creation, update, and deletion of database contents. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, requires no authentication and no user interaction against any reachable Melis instance; publicly available exploit code exists (a dedicated GitHub proof-of-concept), and the vendor/coordinator advisory is published by INCIBE. EPSS is 0.41% (33rd percentile), indicating limited observed exploitation activity, and the flaw is not listed in CISA KEV, so it is not confirmed as actively exploited. Overall risk is high for exposed deployments because database confidentiality, integrity, and availability are all fully compromised, though the practical exposure is bounded by the product's small install base and by whether the administrative endpoint is reachable from untrusted networks.
RemediationAI
At the time of analysis, no vendor-released patched version was identified in the provided data; the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform should be monitored for the official fix and upgrade guidance before any other action, and a released fixed version should be applied as soon as it is published. Until a patch is available, prioritize compensating controls that remove or constrain the vulnerable code path: block or restrict external access to '/melis/MelisCms/PageEdition/getTinyTemplates' at the reverse proxy or WAF (a rule keyed to that path/endpoint is highly targeted and low-risk to legitimate use), and place the entire /melis administrative area behind an authentication gateway, VPN, or strict IP allow-list so only trusted administrators can reach it - the trade-off is reduced administrative accessibility and potential disruption if staff rely on external access. Additionally, deploy WAF SQL-injection signatures tuned to the 'idPage' parameter and enforce least-privilege database credentials for the Melis application account so that even a successful injection cannot perform DDL or access unrelated schemas; this limits blast radius but does not prevent data exfiltration from accessible tables. Note that a public proof-of-concept exploit exists (https://github.com/ivansmc00/CVE-2025-10351-POC), so these controls should be treated as urgent interim measures, not long-term fixes.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL injection in Melis Platform, a PHP-based open-source CMS/e-commerce framework, specifically within its bundled melis-cms module. The affected code path is the TinyMCE template retrieval handler at '/melis/MelisCms/PageEdition/getTinyTemplates', which takes the 'idPage' request parameter and incorporates it into a SQL query without adequate parameterization or input sanitization. Because the parameter can be manipulated to alter query structure, an attacker can influence the underlying database engine directly rather than merely reading page metadata. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) confirms network reachability, low attack complexity, no attack requirements, no privileges, and no user interaction, with high confidentiality, integrity, and availability impact confined to the vulnerable system. Our independent assessment concurs with an equivalent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No CPE strings were provided in the input data, so exact affected product/version identifiers are not enumerated here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable SQLi via a single parameter gives AV:N/AC:L/PR:N/UI:N; read/write/delete on the database yields C:H/I:H/A:H with no scope change (S:U).
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
Executive ViewAI
Melis Platform's melis-cms module is affected by a critical, unauthenticated SQL injection that can let attackers read, modify, or delete the platform's database contents. Although there is no confirmed active exploitation (CISA KEV) and observed exploitation activity is limited, publicly available exploit code exists and no vendor-released patch is identified, so any exposed Melis deployment should be treated as high risk. Leadership should prioritize identifying and isolating affected instances because a successful attack could disrupt CMS operations and compromise sensitive data.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to the vulnerable /melis/MelisCms/PageEdition/getTinyTemplates endpoint via WAF, reverse proxy, VPN, or IP allowlisting; disabling the melis-cms module where not required; isolating Melis Platform servers from sensitive databases; monitoring and alerting on SQL injection attempts against the idPage parameter; and applying vendor guidance from the INCIBE advisory until a fixed release is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB