What’s Vulnerable › Vulnerabilities

CVE-2025-7385: SQL Injection in GOV CMS

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-04 · updated 2026-06-17
• Weakness: CWE-89

Description

Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthenticated remote attacker. Versions 4.0 and above are not affected.

Affected products

• Concept Intermedia GOV CMS: before 4.0 — fixed in 4.0

How to fix

Upgrade to a fixed version: Concept Intermedia GOV CMS 4.0. Check the vendor advisory for mitigations.

References

• https://cert.pl/posts/2025/09/CVE-2025-7385
• https://sam3.pl/strona-305-za_co_nas_cenia_redaktorzy.html

Get alerted when CVE-2025-7385 or the next vulnerability affects your stack