SQL Injection in Vishnusivadas Login-Signup
CVE-2025-51092
The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and signUp() build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareData() function exists, it is insufficient to prevent SQL injection and does not sanitize the table name.
Vulnerability class: SQL Injection
EPSS: 0.004 (33.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Vishnusivadas Login-signup
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-51092?
- CVE-2025-51092 is a critical-severity vulnerability in Vishnusivadas Login-Signup, classified under SQL Injection. CVSS score: 9.8/10. Published 2025-08-22.
- How severe is CVE-2025-51092?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2025-51092 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.