Threat Intelligence Database

CVE-2025-67830 is a critical SQL injection vulnerability in Mura CMS versions before 10.1.14, specifically in the beanFeed.cfc component's getQuery sortby parameter. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to full database compromise, including data confidentiality, integrity, and availability impacts. The vulnerability requires no user interaction and can be exploited over the network, making it highly dangerous. Although no known exploits are currently reported in the wild, the high CVSS score of 9.8 indicates severe risk. Organizations using vulnerable Mura CMS versions should prioritize patching once available or apply immediate mitigations to prevent exploitation. Countries with significant Mura CMS usage and critical infrastructure relying on it are at higher risk.

CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-67830

CVE-2025-67829 is a critical SQL injection vulnerability affecting Mura CMS versions prior to 10.1.14. The flaw exists in the beanFeed.cfc component's getQuery function, which improperly handles the sortDirection parameter, allowing an attacker to inject malicious SQL code. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Successful exploitation can lead to full compromise of the affected system, including unauthorized data disclosure, data modification, and potential system availability disruption. Although no known exploits are currently in the wild, the high CVSS score of 9.8 indicates a severe risk. Organizations using vulnerable Mura CMS versions should prioritize patching or applying mitigations immediately to prevent exploitation.

CriticalVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2025-67829