What is CVE-2025-22964?

CVE-2025-22964 is a high-severity vulnerability in Ddsn Cm3 Acora Content Management System, classified under SQL Injection. CVSS score: 8.1/10. Published 2025-01-15.

How severe is CVE-2025-22964?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2025-22964 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Ddsn Cm3 Acora Content Management System

CVE-2025-22964

DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application.

Vulnerability class: SQL Injection

EPSS: 0.009 (56.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Ddsn Cm3_acora_content_management_system — versions 10.1.1
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

References

cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2025-22964?: CVE-2025-22964 is a high-severity vulnerability in Ddsn Cm3 Acora Content Management System, classified under SQL Injection. CVSS score: 8.1/10. Published 2025-01-15.
How severe is CVE-2025-22964?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2025-22964 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.