CVE-2025-7102

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
n/a	BoyunCMS	1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; 1.4.6; 1.4.7; 1.4.8; 1.4.9; 1.4.10; 1.4.11; 1.4.12; 1.4.13; 1.4.14; 1.4.15; 1.4.16; 1.4.17; 1.4.18; 1.4.19

References

https://note-hxlab.wetolink.com/share/sEjaSsXWRNz1Broken Link
https://vuldb.com/?ctiid.315016Permissions Required, VDB Entry
https://vuldb.com/?id.315016Third Party Advisory, VDB Entry
https://vuldb.com/?submit.604401Third Party Advisory, VDB Entry
https://note-hxlab.wetolink.com/share/sEjaSsXWRNz1Broken Link

Timeline

Published: Jul 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-710207.5Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. This vulnerability al CVE-2025-710217.5Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability CVE-2025-710237.5Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulner CVE-2025-710247.5Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. Thi CVE-2025-710257.5Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This CVE-2025-710267.5Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This v CVE-2025-710277.5Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vul CVE-2025-71037.5A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /a CVE-2025-710317.5Water-Melon Melon commit 9df9292 and below is vulnerable to Denial of Service. The HTTP component doesn't have any maximum length. As a resu CVE-2025-71047.5A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate s CVE-2025-71055.7A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous c CVE-2025-710568.1Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing t