CVE-2025-15498

Critical

Published: 27/02/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Pro3W CMS is vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges. This issue was identified in version 1.2.0. Due to lack of response from the vendor, exact version range could not be determined, but the vulnerability should be eliminated in versions released in January 2026 and later.

Risk Assessment

The risk involves potential unauthorized access to the admin panel, which could lead to full compromise of the CMS system and data breach.

Recommendation

It is recommended to update Pro3W CMS to the latest version released after January 2026 and implement security measures such as parameterized SQL queries.

Original NVD description (English source)

Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges. This issue was identified in version 1.2.0 of this software. Due to lack of response from the vendor exact version range could not be determined, but the vulnerability should be eliminated in versions released in January 2026 and later.