CVE-2025-15498
SQL Injection in Pro3W CMS
No sign of exploitation. No public exploitation artifact known so far.
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
27 Feb 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges.
This issue was identified in version 1.2.0 of this software. Due to lack of response from the vendor exact version range could not be determined, but the vulnerability should be eliminated in versions released in January 2026 and later.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
Pro3W · Pro3W CMS