What is the CVSS score of CVE-2025-70397?

CVE-2025-70397 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jizhicms are affected by CVE-2025-70397?

JizhiCMS 2.5.6 contains a critical SQL injection vulnerability in article and template deletion functions that could allow attackers to access, modify, or delete sensitive database content.

Is there a public PoC exploit available for CVE-2025-70397?

Yes, a public proof-of-concept exploit is available for CVE-2025-70397. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-70397?

Within 24 hours: Identify all systems running JizhiCMS 2.5.6 and assess internet exposure. Within 7 days: Implement WAF rules blocking malicious payloads to the affected endpoints (/Article/deleteAll and /Extmolds/deleteAll), restrict access to these functions via network segmentation, and disable deletion features if not operationally critical. Within 30 days: Upgrade to a patched version or migrate to an alternative CMS solution, as no patch is currently available from the vendor.

Jizhicms CVE-2025-70397

HIGH

SQL Injection (CWE-89)

2026-02-17 cve@mitre.org

SQLi Jizhicms

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 19, 2026 - 18:24 vuln.today

Public exploit code

CVE Published

Feb 17, 2026 - 16:20 nvd

HIGH 7.2

DescriptionCVE.org

jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.

AnalysisAI

jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter. [CVSS 7.2 HIGH]

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the data component of Jizhicms. jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.