SQL Injection in Concept Intermedia Gov Cms
CVE-2025-7385
Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthenticated remote attacker. Versions 4.0 and above are not affected.
Vulnerability class: SQL Injection
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (36.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Concept Intermedia Gov Cms — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/posts/2025/09/CVE-2025-7385 (third-party-advisory)
- sam3.pl/strona-305-za_co_nas_cenia_redaktorzy.html (product)
Frequently asked questions
- What is CVE-2025-7385?
- CVE-2025-7385 is a vulnerability in Concept Intermedia Gov Cms, classified under SQL Injection. Published 2025-09-04.
- Is CVE-2025-7385 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.