CVE-2025-4514

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some unknown functionality of the file /javascript.php. The manipulation of the argument Value leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Zhengzhou Jiuhua Electronic Technology	mayicms	5.8E

References

https://github.com/Axianke/cve/issues/1Broken Link
https://vuldb.com/?ctiid.308234Permissions Required, VDB Entry
https://vuldb.com/?id.308234Third Party Advisory, VDB Entry
https://vuldb.com/?submit.564243Third Party Advisory, VDB Entry
https://github.com/Axianke/cve/issues/1Broken Link

Timeline

Published: May 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-451437.0string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.CVE-2025-451457.5Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attackers to read arbitra CVE-2025-451469.8ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. Thi CVE-2025-45156.5A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file se CVE-2025-451509.8Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying CVE-2025-451565.3Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.CVE-2025-451576.5Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users.CVE-2025-45165.9There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" CVE-2025-451605.4A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, t CVE-2025-45179.4Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnera CVE-2025-45198.8The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missin CVE-2025-45204.3The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple