What is the CVSS score of CVE-2025-5434?

CVE-2025-5434 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-5434?

A critical SQL injection vulnerability in Aem Solutions CMS versions up to 1.0 allows unauthenticated remote attackers to compromise database integrity and confidentiality.

How to fix or mitigate CVE-2025-5434?

Within 24 hours: Identify all systems running Aem Solutions CMS up to version 1.0 and isolate affected instances from production networks if possible. Within 7 days: Implement WAF rules to block malicious SQL injection patterns targeting /page.php ID parameter, enable SQL query logging and monitoring, and conduct immediate database access audit for suspicious activities. Within 30 days: Evaluate alternative CMS solutions or contact vendor for timeline commitment; if remaining on platform, implement network segmentation to restrict CMS database access and deploy additional intrusion detection rules.

PHP CVE-2025-5434

EUVD-2025-16617 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-02 cna@vuldb.com

PHP SQLi

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16617

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 07:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Aem Solutions CMS up to 1.0. It has been classified as critical. This affects an unknown part of the file /page.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Critical SQL injection vulnerability in Aem Solutions CMS versions up to 1.0, affecting the /page.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands. With a CVSS score of 7.3, a publicly disclosed exploit, and unresponsive vendor engagement, this vulnerability poses significant risk to confidentiality, integrity, and availability of affected systems.

Technical ContextAI

The vulnerability exists in Aem Solutions CMS (CPE: cpe:2.3:a:aem_solutions:cms:*:*:*:*:*:*:*:* with versions <= 1.0) as a CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') flaw. The /page.php file fails to properly sanitize or parameterize the 'ID' parameter before incorporating it into SQL queries, enabling classic SQL injection attacks. CWE-74 encompasses injection vulnerabilities where user-supplied input is not neutralized before being passed to SQL command execution contexts, allowing attackers to break out of intended query syntax and execute unauthorized database operations.

RemediationAI

priority: URGENT; action: Immediate mitigation required - No vendor patch available; steps: ['1. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the ID parameter of /page.php (e.g., detect single quotes, SQL keywords, comment sequences)', '2. Apply input validation: restrict ID parameter to expected format (alphanumeric/numeric only if applicable)', '3. Implement parameterized queries/prepared statements in /page.php to separate SQL syntax from data', '4. Apply output encoding to prevent SQL injection from user-controlled input', '5. Disable error messages revealing database schema information', '6. Consider upgrading to a different CMS vendor given lack of vendor support for Aem Solutions CMS', '7. Implement database-level access controls to limit query scope and privilege escalation risk', '8. Monitor database query logs for suspicious SQL patterns']
priority: HIGH; action: Network segmentation; steps: ['Restrict network access to Aem Solutions CMS instances to trusted networks only', 'Disable public internet exposure if possible until remediation is complete']