EUVD-2025-201696Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires low-privilege authenticated access to /edit.php; successful SQLi leads to limited confidentiality, integrity, and availability impacts.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A security flaw has been discovered in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. This issue affects some unknown processing of the file /edit.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Philipinho Simple-PHP-Blog up to commit 94b5d3e allows low-privileged remote attackers to manipulate SQL queries via the /edit.php endpoint. An exploit is publicly available, but no active exploitation in the wild is reported. EPSS probability is very low (0.04%).
Technical ContextAI
Simple-PHP-Blog is a PHP-based blogging application using a rolling release model. The flaw resides in /edit.php, which fails to properly neutralize special elements (CWE-74) in user-supplied input before passing it to SQL statements, resulting in SQL injection. The CPE cpe:2.3:a:philipinho:simple-php-blog:*:*:*:*:*:*:*:* confirms the product and indicates all versions are affected.
RemediationAI
No vendor patch is available, and the vendor did not respond to disclosure. As a workaround, restrict access to /edit.php to trusted users only-implement IP whitelisting or enforce strong authentication. Disable the blog if it is not essential, or deploy a Web Application Firewall to block SQL injection payloads. Migrating to an actively maintained alternative is recommended for permanent mitigation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today