CVE-2025-5569

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the function Article/Goods of the file /api/v1.index.article/getList.html. The manipulation of the argument Field leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.8 is able to address this issue. The patch is named 935aceb4c21338633de6d41e13332f7b9db4fa6a. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
n/aIdeaCMS1.2; 1.3; 1.4; 1.5; 1.6; 1.7

References

Timeline

Published
Jun 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-556907.0Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-556917.0Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-556927.8Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally.CVE-2025-556937.0Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.CVE-2025-556947.8Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.CVE-2025-556953.3Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally.CVE-2025-556967.0Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs.h) allows an authorized attacker to elevate prCVE-2025-556977.8Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally.CVE-2025-556987.7Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a network.CVE-2025-556995.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-55705.4The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versionCVE-2025-557004.3Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networ
CVE-2025-5569: High severity, CVSS 8.8 | Vulnix