CVE-2025-15392

MediumCVSS 6.3

Published: 31/12/2025(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A vulnerability has been identified in Kohana KodiCMS up to 13.82.135, affecting the like function in cms/modules/pages/classes/kodicms/model/page.php of the Search API Endpoint component. Manipulating the keyword argument can lead to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

Risk Assessment

An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access or modification. The public availability of the exploit increases the risk of exploitation.

Recommendation

Immediately update KodiCMS to the latest version if available, and use parameterized SQL queries. Monitor logs for unusual requests to the Search API.

Other vulnerabilities in KodiCMS

CVE-2025-15393Medium
A vulnerability was detected in Kohana KodiCMS up to version 13.82.135. The Save function in the file cms/modules/kodicms/classes/kodicms/model/file.php of the Layout API Endpoint component allows code injection via manipulation of the content argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php of the component Search API Endpoint. Executing manipulation of the argument keyword can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS