CVE-2025-2248

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-224807.8Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with localCVE-2025-224818.8A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could CVE-2025-224828.1A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could CVE-2025-224834.8A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains anCVE-2025-224847.1An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gainCVE-2025-224868.8An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remCVE-2025-22498.8The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_CVE-2025-224907.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can thCVE-2025-224916.7The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead inCVE-2025-224926.3The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for CVE-2025-224935.6Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the seCVE-2025-224958.4An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in