CVE-2018-25424

8.8 highEPSS 0.3%

Gate Pass Management System 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the login and password parameters. Attackers can submit crafted POST requests to login-exec.php with SQL injection payloads in form parameters to authenticate without valid credentials and gain access to the application.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-05-30
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

References

http://www.livebms.com
https://netcologne.dl.sourceforge.net/project/gatepass/gpms_Update.zip
https://www.exploit-db.com/exploits/45766
https://www.vulncheck.com/advisories/gate-pass-management-system-sql-injection-via-login-exec-php

Check your stack JSON