CVE-2018-25319: Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php
Published May 17, 2026
·Updated
Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the myeventsid parameter. Attackers can send GET requests to the eventadd.php page with malicious myeventsid values to extract or modify sensitive database information.
Affected Software
1 affected component
REDAXO MyEvents=2.2.1
Event History
May 17, 2026
CVE Published
via MITRE·12:11 PM
Data Sourced
via MITRE·12:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-25319?
CVE-2018-25319 is classified as a critical SQL injection vulnerability.
2
How do I fix CVE-2018-25319?
To fix CVE-2018-25319, upgrade the Redaxo CMS Addon MyEvents to a version later than 2.2.1.
3
What type of vulnerability is CVE-2018-25319?
CVE-2018-25319 is an SQL injection vulnerability.
4
Who is affected by CVE-2018-25319?
CVE-2018-25319 affects users of Redaxo CMS Addon MyEvents version 2.2.1.
5
What could an attacker achieve with CVE-2018-25319?
An attacker could potentially manipulate database queries and gain unauthorized access to sensitive data.