CVE-2025-1869

CVE-2025-1869 is a SQL injection vulnerability (CWE-89) discovered in the 101news software, affecting version 1.0 via the "username" parameter in the admin/check_avalability.php component. Published on 2025-03-03T13:15:11.950, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread remote exploitation.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact consequences across confidentiality, integrity, and availability, allowing arbitrary SQL code execution to extract sensitive data, modify database contents, or disrupt service availability.

The INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-101news provides details on this and related vulnerabilities in 101news, including recommended mitigations.