CVE-2025-25426: SQL Injection
Published Mar 4, 2025
·Updated
yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.
Affected Software
2 affected components
yshopmall yshopmall<=1.9.0
guchengwuyue yshopmall<=1.9.0
Event History
Mar 4, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-25426?
CVE-2025-25426 is classified as a critical vulnerability due to its potential for SQL Injection attacks.
2
How do I fix CVE-2025-25426?
To fix CVE-2025-25426, upgrade yshopmall to version 1.9.1 or later, which contains the necessary security patches.
3
What are the potential impacts of CVE-2025-25426?
CVE-2025-25426 can allow attackers to execute arbitrary SQL queries, potentially compromising the database.
4
Which versions of yshopmall are affected by CVE-2025-25426?
yshopmall versions up to and including 1.9.0 are affected by CVE-2025-25426.
5
Is there a workaround for CVE-2025-25426 until I can upgrade?
While the best solution is to upgrade, a temporary workaround is to sanitize user inputs and use prepared statements in SQL queries.