VulnerabilityDeferred

CVE-2025-8536

A SQL injection vulnerability has been identified in DobryCMS.

CRITICAL 9.3EPSS 0.28%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks. This issue affects older branches of this software.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.28% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-89
Source: cvd@cert.pl

References

https://cert.pl/posts/2025/10/CVE-2025-8536
https://studiofabryka.pl/systemy_cms.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.