CVE-2025-15443

HighCVSS 7.2/10Last modified Oct 14, 2026

Description

A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation of the argument cate_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
n/a	CRMEB	5.6.0; 5.6.1

References

https://github.com/En0t5/vul/blob/main/crmeb/crmeb-product-productExport-SQL.mdExploit, Third Party Advisory
https://github.com/En0t5/vul/blob/main/crmeb/crmeb-product-productExport-SQL.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.339465Permissions Required, VDB Entry
https://vuldb.com/?id.339465Third Party Advisory, VDB Entry
https://vuldb.com/?submit.721916Third Party Advisory, VDB Entry

Timeline

Published: Jan 4, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-154449.8Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version o CVE-2025-154455.4The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any CVE-2025-154489.8A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the f CVE-2025-154499.1A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of t CVE-2025-15457.5An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information fro CVE-2025-154506.3A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the CVE-2025-154514.8A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/sy CVE-2025-154524.8A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.d CVE-2025-154536.3A security vulnerability has been detected in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/exp CVE-2025-154543.1A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/Article CVE-2025-154556.5A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the compon CVE-2025-154567.5A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php