CVE-2025-15392

MEDIUM

KodiCMS < 13.82.135 - SQL Injection via Search API Endpoint Keyword Parameter

Title source: llm

Description

A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php of the component Search API Endpoint. Executing manipulation of the argument keyword can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.339161

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.339161

Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.718289

Scores

CVSS v3 6.3

EPSS 0.0025

EPSS Percentile 15.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

kodicms-kohana/kodicms < 13.82.135

Published Dec 31, 2025

Tracked Since Feb 18, 2026