What’s Vulnerable › Vulnerabilities
CVE-2025-12462: Blind SQL Injection in DobryCMS
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-02 · updated 2026-06-17
- Weakness: CWE-89
Description
A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple parameters resulting in Blind SQL Injection. This issue was fixed in versions above 8.0.
Affected products
- Studio Fabryka DobryCMS: before 8.0 — fixed in 8.0
How to fix
Upgrade to a fixed version: Studio Fabryka DobryCMS 8.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-12462 or the next vulnerability affects your stack