Which versions of Simple Forum are affected by CVE-2025-6847?

Organizations using A vulnerability classified as critical should be aware of moderate risk from CVE-2025-6847, a injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-6847?

Yes, a public proof-of-concept exploit is available for CVE-2025-6847. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6847?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Simple Forum CVE-2025-6847

Q: What is the CVSS score of CVE-2025-6847?

CVE-2025-6847 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19474 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-29 cna@vuldb.com

PHP SQLi Simple Forum Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network attack vector, low complexity, low privileges required, no user interaction, limited impact on confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 01:15 euvd

EUVD-2025-19474

Analysis Generated

Mar 16, 2026 - 01:15 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 29, 2025 - 06:15 nvd

MEDIUM 6.3

CVE Published

Jun 29, 2025 - 06:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability classified as critical was found in code-projects Simple Forum 1.0. This vulnerability affects unknown code of the file /forum_edit.php. The manipulation of the argument iii leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Simple Forum 1.0 allows remote attackers to manipulate the 'iii' parameter in /forum_edit.php, potentially leading to unauthorized database access. A public proof-of-concept exploit exists, though no active exploitation has been confirmed. The vulnerability affects an open-source PHP forum application.

Technical ContextAI

Simple Forum is a PHP-based forum application. The vulnerability is in the file /forum_edit.php, where the parameter 'iii' is used in constructing a database query without proper sanitization, leading to an SQL injection flaw. This is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CPE string identifies the product as version 1.0, likely distributed through platforms like code-projects.org.

RemediationAI

No vendor-released patch has been identified for Simple Forum 1.0 at this time. As an immediate workaround, apply input validation to the 'iii' parameter in /forum_edit.php by using parameterized queries or escaping special characters. Alternatively, restrict network access to the forum application or disable the forum editing feature if not needed. Monitor the VulDB entry for any updates.