Form Maker By 10Web CVE-2025-15441

The CVSS score of 6.8 (medium-high) reflects high confidentiality impact (C:H) but no integrity or availability damage, indicating data exfiltration rather than system compromise. However, several factors moderate real-world risk: EPSS percentile of 6% (0.02% probability) is exceptionally low, suggesting minimal exploitation in the wild despite public POC availability. CISA SSVC framework confirms exploitation is possible (POC exists) but marks it as non-automatable and partially impactful, aligning with the high-complexity attack vector (AC:H) in CVSS. The unauthenticated remote vector (PR:N, AV:N) is concerning, but the requirement for high complexity and the narrow scope (MySQL Mapping feature must be enabled) limits the attack surface. Organizations running Form Maker should prioritize patching based on deployment prevalence and MySQL Mapping usage rather than raw CVSS score.

An attacker identifies a Form Maker by 10Web installation with MySQL Mapping enabled by probing form submission endpoints. They craft a malicious form field value containing SQL injection payload (such as UNION-based or time-based blind SQL injection) that bypasses the insufficient input validation. Upon form submission, the injected SQL is executed in the context of the database query, allowing the attacker to extract sensitive data such as user credentials, customer information, or other database contents. Public exploit code reduces the barrier to exploitation, though the attack requires careful payload crafting due to high complexity constraints.