What is the CVSS score of EUVD-2025-28309?

EUVD-2025-28309 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-28309?

A critical SQL injection vulnerability (CVE-2025-49452, CVSS 9.3) affects PostaPanduri versions through 2.1.3, allowing unauthenticated attackers to execute arbitrary database commands and…

How to fix or mitigate EUVD-2025-28309?

Within 24 hours: Identify all systems running PostaPanduri versions ≤2.1.3 and isolate them from production networks if possible; enable enhanced logging and monitoring for SQL injection attempts. Within 7 days: Implement WAF rules to block SQL injection payloads targeting PostaPanduri; apply network segmentation to restrict database access; disable PostaPanduri if not business-critical. Within 30 days: Evaluate upgrading to patched versions when available; conduct forensic analysis for signs of exploitation; review database access logs for unauthorized queries.

Wordpress Plugin EUVD-2025-28309

| CVE-2025-49452 CRITICAL

SQL Injection (CWE-89)

2025-06-17 audit@patchstack.com

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28309

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri allows SQL Injection. This issue affects PostaPanduri: from n/a through 2.1.3.

AnalysisAI

Critical SQL injection vulnerability in Adrian Ladó's PostaPanduri application (versions up to 2.1.3) that allows unauthenticated remote attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 9.3 with network-based attack vector and no authentication required, enabling attackers to extract sensitive data from the database and potentially cause service disruption. Real-world exploitation risk is elevated due to the complete lack of authentication requirements and straightforward attack vector.

Technical ContextAI

PostaPanduri is a web application framework/CMS developed by Adrian Ladó. The vulnerability stems from improper neutralization of special SQL metacharacters in user-supplied input (CWE-89), indicating that the application fails to properly sanitize or parameterize SQL queries. This is a classic SQL injection flaw where user input is concatenated directly into SQL commands without proper escaping, prepared statements, or input validation. The affected software processes user input through web interfaces that construct dynamic SQL queries, allowing attackers to manipulate query logic by injecting SQL syntax (e.g., UNION, OR, DROP, SELECT). CPE identifier would be: cpe:2.3:a:adrian_lado:postapanduri:*:*:*:*:*:*:*:* with versions from unspecified through 2.1.3 marked as vulnerable.