CVE-2025-10115

A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name/userName causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

• CWE-74
• CWE-89

• https://github.com/drew-byte/SiempreCMS-SQLi-POC
• https://vuldb.com/?ctiid.323084
• https://vuldb.com/?id.323084
• https://vuldb.com/?submit.645531

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1011A bug in WebAssembly code generation could have lead to a cr…8.8
• CVE-2025-10110A vulnerability was identified in ChanCMS up to 3.3.1. Impac…8.8
• CVE-2025-10111A security flaw has been discovered in itsourcecode Student …9.8
• CVE-2025-10112A weakness has been identified in itsourcecode Student Infor…9.8
• CVE-2025-10113A security vulnerability has been detected in itsourcecode S…9.8
• CVE-2025-10114A vulnerability was found in PHPGurukul Small CRM 4.0. Affec…9.8
• CVE-2025-10116A vulnerability was identified in SiempreCMS up to 1.3.6. Th…7.3
• CVE-2025-10117A weakness has been identified in SourceCodester Simple To-D…5.4
• CVE-2025-10118A security vulnerability has been detected in itsourcecode E…9.8
• CVE-2025-1012A race during concurrent delazification could have led to a …7.5
• CVE-2025-10120A vulnerability was detected in Tenda AC20 up to 16.03.08.12…8.8
• CVE-2025-10121A flaw has been found in uverif up to 3.2. This affects the …6.3