CVE-2025-28100
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Apr 15, 2025
Updated: Apr 22, 2025
CWE ID 89
Summary
CVE-2025-28100 is a SQL Injection vulnerability affecting the dingfanzuCMS version 1.0. An attacker can exploit this vulnerability by supplying malicious input to the "operateOrder.php" id parameter, which is not filtered correctly. This allows the attacker to inject and execute arbitrary SQL code, potentially leading to unauthorized data access or system compromise. Users are advised to update their dingfanzuCMS installations as soon as possible to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Dingfanzu CMS