CVE-2025-2132

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 9, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-213205.5Windows Kernel Memory Information Disclosure VulnerabilityCVE-2025-213215.5Windows Kernel Memory Information Disclosure VulnerabilityCVE-2025-213227.8Microsoft PC Manager Elevation of Privilege VulnerabilityCVE-2025-213235.5Windows Kernel Memory Information Disclosure VulnerabilityCVE-2025-213246.6Windows Digital Media Elevation of Privilege VulnerabilityCVE-2025-213257.8Windows Secure Kernel Mode Elevation of Privilege VulnerabilityCVE-2025-213267.8Internet Explorer Remote Code Execution VulnerabilityCVE-2025-213276.6Windows Digital Media Elevation of Privilege VulnerabilityCVE-2025-213284.3MapUrlToZone Security Feature Bypass VulnerabilityCVE-2025-213294.3MapUrlToZone Security Feature Bypass VulnerabilityCVE-2025-21334.8A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /adCVE-2025-213307.5Windows Remote Desktop Services Denial of Service Vulnerability
CVE-2025-2132: High severity, CVSS 7.2 | Vulnix