CVE-2022-27985

CriticalCVSS 9.8

Published: 26/04/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.68%

93th percentile - higher than 93% of all known CVEs

Summary

CuppaCMS v1.0 contains a SQL injection vulnerability in the file /administrator/alerts/alertLightbox.php. An attacker can exploit this flaw to execute unauthorized database queries.

Risk Assessment

The risk involves potential theft, modification, or deletion of database data, which could compromise the confidentiality and integrity of the CMS system.

Recommendation

Immediately update CuppaCMS to the latest version or apply a security patch. If an update is not available, restrict access to the alertLightbox.php file to trusted IP addresses only.

Original NVD description (English source)

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.