VulnSocial

CVE-2025-12462Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A Blind SQL injection vulnerability has been identified in DobryCMS.  A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple parameters resulting in Blind SQL Injection. This issue was fixed in versions above 8.0.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 3 mentions (2026-03-02); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-03-02: 3Mentions · 2026-03-31: 1PoC Mentioned / Linked · 2026-03-31: 1Technical Details · 2026-03-02: 3Technical Details · 2026-03-31: 103-0203-31
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-03-023
Disclosure3
2026-03-311
Disclosure1
Full discourse4 posts
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2025-12462: Blind S... Unauthenticated blind SQLi via URL path params hitting 9.3 CVSS - complete database extraction without leaving logs. #BlindSQLi #DobryCMS #0day. https://zerodaysignal.com/vulnerability/CVE-2025-12462 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    A new zero‑day CVE‑2025‑12462 is disclosed as a blind SQL injection with a CVSS of 9.3, enabling full database extraction without logs; no patch or PoC is described in the text.

    00000203
    194 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2025-12462 Blind SQL Injection Vulnerability in DobryCMS Versions 8.0 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-12462

    Post summary

    The text announces a blind SQL injection vulnerability in DobryCMS 8.0 and earlier, providing only the vulnerability type and affected versions without any PoC, exploit, or patch details.

    0000077
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2025-12462 A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path resulting in Blind S… https://www.cve.org/CVERecord?id=CVE-2025-12462 ----- Traducción: CVE-2025-12462 Se … http://infoflow.cloud`

    Post summary

    The post announces CVE‑2025‑12462, a blind SQL injection in DobryCMS that allows unauthenticated remote attackers to inject SQL via the URL path.

    0000098
    55 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-12462 A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path resulting in Blind S… https://www.cve.org/CVERecord?id=CVE-2025-12462

    Post summary

    A blind SQL injection vulnerability (CVE-2025-12462) in DobryCMS allows unauthenticated remote attackers to inject SQL via the URL path.

    00000311
    56.6K followersView on X

Explore more

Back to dashboard