CVE-2025-12465

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

• CWE-89

• https://cert.pl/posts/2025/12/CVE-2025-12465/

Published

Dec 2, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1246Improper Restriction of Operations within the Bounds of a Me…7.8
• CVE-2025-12460An XSS issue was discovered in Afterlogic Aurora webmail ver…5.3
• CVE-2025-12461This vulnerability allows an attacker to access parts of the…6.9
• CVE-2025-12462A Blind SQL injection vulnerability has been identified in D…9.3
• CVE-2025-12463An unauthenticated SQL Injection was discovered within the G…9.8
• CVE-2025-12464A stack-based buffer overflow was found in the QEMU e1000 ne…6.2
• CVE-2025-12466Authentication Bypass Using an Alternate Path or Channel vul…7.5
• CVE-2025-12468The FunnelKit Automations – Email Marketing Automation and C…5.3
• CVE-2025-12469The FunnelKit Automations – Email Marketing Automation and C…4.3
• CVE-2025-1247A flaw was found in Quarkus REST that allows request paramet…8.3
• CVE-2025-12471The Hubbub Lite – Fast, free social sharing and follow butto…6.1
• CVE-2025-12472An attacker with a Looker Developer role could manipulate a …7.1