CVE-2018-25179 - Gumbo CMS 0.99 SQL Injection via settings endpoint

Back Back to CVE browser

HIGH

Gumbo CMS 0.99 SQL Injection via settings endpoint

Published Mar 6, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.24%

Description

Gumbo CMS 0.99 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the language parameter. Attackers can send POST requests to the settings endpoint with crafted SQL payloads in the language parameter to extract sensitive database information including usernames, databases, and version details.

Affected products

Vendor Gumbo-Cms Product Gumbo CMS Default
n/a
- Version
  0.99
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Gumbo-Cms

Gumbo CMS

n/a

Version	Status	Constraints
0.99	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21634
Advisory
https://www.exploit-db.com/exploits/45837
exploit
https://www.vulncheck.com/advisories/gumbo-cms-sql-injection-via-settings-endpoint
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21634		Advisory
https://www.exploit-db.com/exploits/45837		exploit
https://www.vulncheck.com/advisories/gumbo-cms-sql-injection-via-settings-endpoint		third-party-advisory