CVE-2025-22964HIGH 8.1EPSS p55.2%

CVE-2025-22964CVE-2025-22964

Description

DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application.

Scoring

CVSS 3.18.1 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS0.91% probability of exploitation · percentile 55.2% · 2026-06-19T12:03:05Z
Published2025-01-15
Last modified2025-10-03

Underlying weaknesses· 1

CWE-89

References

  1. https://github.com/padayali-JD/CVE-2025-22964

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')cwe-890%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-25967
CVE
CVE-2025-40656
CVE
CVE-2025-63314
CVE
CVE-2025-40655
CVE
CVE-2025-40657
CVE
CVE-2025-40654
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.