CVE-2025-10351
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A SQL injection vulnerability in the melis-cms module of the Melis platform from Melis Technology allows an attacker to retrieve, create, update, and delete databases. The vulnerability occurs in the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
Risk Assessment
An attacker could gain full access to the database, potentially leading to leakage, modification, or loss of organizational data.
Recommendation
Immediately update the Melis platform to a version containing the fix and implement input validation and SQL query parameterization.
Other vulnerabilities in Melis Platform
See all- CVE-2025-10353Critical
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
- CVE-2025-10352Critical
A vulnerability in the melis-core module of Melis Technology's Melis Platform allows an unauthenticated attacker to create an administrator account. Exploitation occurs via a request to the '/melis/MelisCore/ToolUser/addNewUser' endpoint.
Original NVD description (English source)
SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS