CVE-2025-8536
published 2025-10-24CVE-2025-8536: A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL…
PriorityP358critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.27%
19.2th percentile
A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks.
This issue affects older branches of this software.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| studio_fabryka | dobrycms | < 3.0 | 3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS Xerox FreeFlow Core Arbitrary File Upload/Directory Traversal Attempt (CVE-2025-8356)
suricata·2025-08-13·CVSS 9.8
CVE-2025-8536 [CRITICAL] ET WEB_SPECIFIC_APPS Xerox FreeFlow Core Arbitrary File Upload/Directory Traversal Attempt (CVE-2025-8356)
ET WEB_SPECIFIC_APPS Xerox FreeFlow Core Arbitrary File Upload/Directory Traversal Attempt (CVE-2025-8356)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Xerox FreeFlow Core Arbitrary File Upload/Directory Traversal Attempt (CVE-2025-8356)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:1; content:"/"; http.content_type; content:"multipart/related"; http.request_body; content:"application/vnd.cip4-jmf+xml"; fast_pattern; content:"Content-Disposition|3a 20|attachment|3b 20|filename|3d 22|"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x2e|%2[Ee]){1,2}(?:\x2f|\x5c|%5[Cc]|%2[Ff]){1,}){2,}/R"; reference:url,horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/; reference:cve,2025-8536; reference:cve,2025-8356; classtype:attempted-adm
No public exploits indexed.
No writeups or analysis indexed.
2025-10-24
Published