PT-2025-36536 · Unknown · Siemprecms
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
SiempreCMS versions up to 1.3.6
Description:
A SQL injection issue exists in the
user search ajax.php file of SiempreCMS. Manipulation of the name/userName argument can trigger the issue. The attack can be initiated remotely, and the exploit has been publicly disclosed.Recommendations:
Update to a version later than 1.3.6. As a temporary workaround, restrict access to the
user search ajax.php file.Exploit
Fix
Special Elements Injection
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Siemprecms