What is the CVSS score of CVE-2025-12465?

CVE-2025-12465 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of QuickCMS. Improper are affected by CVE-2025-12465?

A critical SQL injection vulnerability in QuickCMS version 6.8 allows authenticated administrators to manipulate database queries through the file deletion function, potentially leading to…

How to fix or mitigate CVE-2025-12465?

Within 24 hours: Inventory all QuickCMS deployments and confirm version numbers; restrict administrative access to QuickCMS file management functions to essential personnel only; enable database activity monitoring. Within 7 days: Deploy WAF rules to detect and block SQL injection patterns in file deletion requests; implement network segmentation to limit database access from application servers; conduct access review of all high-privileged QuickCMS accounts. Within 30 days: Contact vendor for patch availability and timeline; evaluate alternative CMS solutions if patches remain unavailable; perform penetration testing on affected systems post-remediation.

QuickCMS. Improper CVE-2025-12465

EUVD-2025-200223 HIGH

SQL Injection (CWE-89)

2025-12-02 cvd@cert.pl

SQLi

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200223

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 13:15 nvd

HIGH 8.6

DescriptionCVE.org

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Analysis

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks.