{"answers":{"affected":"2 open source packages ship an affected version, including melisplatform/melis-cms.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10351 exists.","fix":"Upgrade melisplatform/melis-cms to 5.3.4 or later.","what":"CVE-2025-10351 is a critical SQL injection vulnerability in Melis Platform, published on 8 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-10351 and fix it if it is affected.\n\nWhat it is: CVE-2025-10351 is a critical SQL injection vulnerability in Melis Platform, published on 8 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10351 exists.\n\nAffected packages and fixed versions:\n- melisplatform/melis-cms (Packagist): affected all versions; fixed in 5.3.4\n- melisplatform/melis-cms (Packagist): affected all versions; fixed in 5.3.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-10351/ (Markdown: https://insights.sbomify.com/CVE-2025-10351/index.md)","id":"CVE-2025-10351","markdown":"https://insights.sbomify.com/CVE-2025-10351/index.md","name":"CVE-2025-10351","record":{"aliases":["GHSA-mrmx-jfw8-qhgv"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Melis Platform CMS","requires_auth":"none","summary":"Attackers can manipulate the idPage parameter to read, create, update, or delete database records in the Melis Platform CMS.","user_interaction":"not_required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"INCIBE","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"description":"SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":"2025-08-03","github_poc":1,"max_poc_stars":1,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-08-03T11:04:53Z","kind":"github_poc","ref":"https://github.com/ivansmc/CVE-2025-10351-POC","stars":1,"title":"Exploit for CVE-2025-10351. SQL Injection on Melis Platform Framework"}],"tier":"weaponised"},"has_fix":true,"headline":"SQL injection vulnerability in Melis Platform","id":"CVE-2025-10351","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"sql_injection","year":"2025"},"n_packages":2,"n_references":2,"next":{"headline":"Missing Authorization vulnerability in Melis Platform","id":"CVE-2025-10352"},"packages":[{"ecosystem":"Packagist","fixed":["5.3.4"],"introduced":["0"],"last_affected":[],"package":"melisplatform/melis-cms","purl":null,"source":"GHSA-mrmx-jfw8-qhgv"},{"ecosystem":"Packagist","fixed":["5.3.4"],"introduced":["0"],"last_affected":[],"package":"melisplatform/melis-cms","purl":"pkg:composer/melisplatform/melis-cms","source":"GHSA-mrmx-jfw8-qhgv"}],"prev":{"headline":"SQL injection in CGM NETRAAD","id":"CVE-2025-10350"},"products":["Melis Platform"],"published":"2025-10-08","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-12-22","vendors":["Melis Technology"]},"summary":"Attackers can manipulate the idPage parameter to read, create, update, or delete database records in the Melis Platform CMS.","url":"https://insights.sbomify.com/CVE-2025-10351/"}