CVE-2022-50895

CRITICAL

Aero CMS 0.0.1 - SQL Injection

Title source: llm

Description

Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, time-based, and UNION query techniques to extract sensitive database information and potentially compromise the system.

Exploits (1)

exploitdb WORKING POC

by nu11secur1ty · textwebappsphp

https://www.exploit-db.com/exploits/51022

View Code ZIP pw:eip

References (4)

[Various Sources] https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi

[Various Sources] https://web.archive.org/web/20211008092238/https://github.com/MegaTKC/AeroCMS

[Third Party Advisory] https://www.vulncheck.com/advisories/aero-cms-sql-injection

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/51022

Scores

CVSS v3 9.8

EPSS 0.0005

EPSS Percentile 14.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-89

Status published

Affected Products (1)

aerocms_project/aerocms

Timeline

Published Jan 13, 2026

Tracked Since Feb 18, 2026