What’s Vulnerable › Vulnerabilities

CVE-2025-10115: SiempreCMS user_search_ajax.php sql injection

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-09 · updated 2026-10-19
• Weakness: CWE-74

Description

A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name/userName causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Affected products

• SiempreCMS: 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5 (+1)

References

• https://github.com/drew-byte/SiempreCMS-SQLi-POC
• https://vuldb.com/?ctiid.323084
• https://vuldb.com/?id.323084
• https://vuldb.com/?submit.645531

Get alerted when CVE-2025-10115 or the next vulnerability affects your stack