Is there a public PoC exploit available for CVE-2025-15263?

Yes, a public proof-of-concept exploit is available for CVE-2025-15263. Prioritise patching immediately. EPSS: 0.0%.

Simple PHP CMS CVE-2025-15263

Q: What is the CVSS score of CVE-2025-15263?

CVE-2025-15263 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-30 cna@vuldb.com

PHP SQLi Simple Php Cms Biggidroid

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Network-reachable pre-authentication SQLi enables full login bypass and database read/write, justifying C:H and I:H; A:L as service disruption is secondary to data impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:38 vuln.today

CVE Published

Dec 30, 2025 - 19:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in BiggiDroid Simple PHP CMS 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter at /admin/login.php. A public proof-of-concept exploit is available on Gitee, enabling authentication bypass or database exfiltration with no prior credentials required. No vendor patch has been released, and the product is not listed in CISA KEV; however, the public PoC materially lowers the bar for opportunistic exploitation against any internet-exposed installation.

Technical ContextAI

The affected component is the admin authentication handler (/admin/login.php) in BiggiDroid Simple PHP CMS 1.0 (CPE: cpe:2.3:a:biggidroid:simple_php_cms:1.0:*:*:*:*:*:*:*), a PHP-based content management system. The root cause is CWE-74 (Injection), specifically SQL injection: the Username parameter is incorporated into a backend SQL query without parameterization or adequate input sanitization, allowing an attacker to alter query logic. Classic pre-authentication SQLi on login forms enables boolean-based or UNION-based attacks to bypass credential verification entirely or enumerate and extract underlying database contents including stored credentials and site configuration.

RemediationAI

No vendor-released patch has been identified at time of analysis. The most effective immediate compensating control is restricting network access to /admin/login.php via firewall rules or web server configuration (e.g., Apache .htaccess or nginx allow/deny directives) to allowlisted IP addresses only - this directly neutralizes the AV:N attack vector with no application-side trade-offs. Deploying a WAF with SQL injection detection rules (e.g., ModSecurity with OWASP CRS) can provide secondary defense, though WAF bypasses exist and this should not be the sole control. Given the absence of any vendor patch or advisory, migration to an actively maintained CMS is strongly recommended for any production use. Reference: https://vuldb.com/?id.338657 and https://gitee.com/devilrunsun/mywork/issues/IDGMME.