CVE-2025-0489

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Fanli2012	native-php-cms	1.0

References

https://github.com/Fanli2012/native-php-cms/issues/11Exploit, Issue Tracking, Vendor Advisory
https://github.com/Fanli2012/native-php-cms/issues/11#issue-2769999157Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.291934Permissions Required, VDB Entry
https://vuldb.com/?id.291934Third Party Advisory, VDB Entry
https://vuldb.com/?submit.475256Third Party Advisory, VDB Entry
https://github.com/Fanli2012/native-php-cms/issues/11Exploit, Issue Tracking, Vendor Advisory
https://github.com/Fanli2012/native-php-cms/issues/11#issue-2769999157Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Jan 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-04908.8A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processin CVE-2025-04919.8A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. Affected is an unknown function of the file /f CVE-2025-04927.5A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function F CVE-2025-04939.8The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclu CVE-2025-04954.1Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directl CVE-2025-04979.8A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability CVE-2025-04989.8A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability CVE-2025-05007.5An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may al CVE-2025-05017.5An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-i CVE-2025-05029.1Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 b CVE-2025-05035.3Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs an CVE-2025-05045.4Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Man