rahulhoysala/security-research

rahulhoysala/security-research

GitHubGitHub
GitHubgithub.com
Releases0
Repository for public disclosure records of original-research produced vulnerabilities.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-50567↗
10 CRITICAL—

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code execution.