CVE-2018-25204

Library CMS 1.0 SQL Injection via admin login

High8.8EPSS 0.55%

Published: 26 Mar 2026
Updated: 26 Mar 2026
Reserved: 26 Mar 2026
Assigned by: VulnCheck

Description

Library CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can send POST requests to the admin login endpoint with boolean-based blind SQL injection payloads in the username field to manipulate database queries and gain unauthorized access.

Scores

CVSS scores of CVE-2018-25204, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVDNVD · Analyzed	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.55% · top 54% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

Wecodex · Library CMS
- affected 1.0

References (3)

ExploitDB-44728 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
VulnCheck Advisory: Library CMS 1.0 SQL Injection via admin login (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25204](https://trackcve.app/badge/CVE-2018-25204.svg)](https://trackcve.app/cve/CVE-2018-25204)

Record last updated 26 Mar 2026, 18:36 UTC.