CVE-2019-25642 - Bootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact Modules

Back Back to CVE browser

HIGH

Bootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact Modules

Published Mar 24, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.27%

Description

Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the post-id parameter of post-new-submit.php, and the thread-id parameter to extract sensitive database information or cause denial of service.

Affected products

Vendor Bootstrapy Product Bootstrapy CMS Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bootstrapy

Bootstrapy CMS

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

http://bootstrapy.com
product
https://www.exploit-db.com/exploits/46590
exploit
https://www.vulncheck.com/advisories/bootstrapy-cms-lastest-multiple-sql-injection-via-forum-and-contact-modules
third-party-advisory

Link	Providers	Tags
http://bootstrapy.com		product
https://www.exploit-db.com/exploits/46590		exploit
https://www.vulncheck.com/advisories/bootstrapy-cms-lastest-multiple-sql-injection-via-forum-and-contact-modules		third-party-advisory