CVE-2020-37110
60CycleCMS 2.5.2 - 'news.php' SQL Injection Vulnerability
- State
- Published
- Severity
- 8.8 High
- Published
- Feb 3, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 1, 2026
Description
60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries through unvalidated user input. Attackers can exploit vulnerable query parameters like 'title' to inject malicious SQL code and potentially extract or modify database contents. This issue does not involve cross-site scripting.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
60CycleCMSDavidvg |
|
References
- ExploitDB-48177exploit
- Software Download Linkproduct
- VulnCheck Advisory: 60CycleCMS 2.5.2 - 'news.php' SQL Injection Vulnerabilitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.