CVE-2025-50567

CriticalCVSS 10.0/10Last modified Jul 5, 2026

Description

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code execution.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2025
Last modified: Jul 5, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-50579.8A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. Affected by this issue is some unknown fun CVE-2025-505728.8Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be exec CVE-2025-505746.1Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers CVE-2025-505789.8LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` a CVE-2025-505795.3A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to CVE-2025-50589.8The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation CVE-2025-505814.8MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.CVE-2025-505824.8StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Course module.CVE-2025-505834.8StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Student module.CVE-2025-505844.8StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Teacher module.CVE-2025-505858.8StudentManage v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/adminStudentUrl.CVE-2025-505866.5StudentManage v1.0 was discovered to contain Cross-Site Request Forgery (CSRF).