CVE-2015-1576

High

Published: 11/02/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in u5CMS before version 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter in several files and other parameters in various admin scripts.

Risk Assessment

Attackers may gain access to the database, potentially leading to data theft or system compromise. This poses a serious threat to the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update u5CMS to the latest version to eliminate these vulnerabilities. Additionally, implementing security measures such as input validation and restricting access to critical scripts is advisable.

Other vulnerabilities in u5CMS

CVE-2026-14449Medium
u5CMS through v12.8.8 is vulnerable to reflected XSS via the 'thanks' parameter in multiple form components.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php.