Cyber Resilience

CVE-2025-26136

Critical

Published: 04 March 2025

Published
04 March 2025
Modified
24 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 35.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26136 is a critical-severity SQL Injection (CWE-89) vulnerability in Wangl1989 Mysiteforme. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-26136, published on 2025-03-04, is a SQL injection vulnerability (CWE-89) in mysiteforme versions prior to 2025.01.1. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact across confidentiality, integrity, and availability.

Remote attackers require no authentication privileges or user interaction and can exploit the issue over the network with low attack complexity. Successful exploitation enables arbitrary SQL injection, allowing attackers to read sensitive data, modify database contents, execute administrative operations, or cause denial of service.

The reference advisory at https://gist.github.com/xiadmin6/6d664692d31a04eb59096a488b9f3712 provides details on mitigation, which includes upgrading to mysiteforme version 2025.01.1 or later to address the vulnerability in affected versions.

EU & UK References

Vulnerability details

A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app directly enables T1190 for initial access; arbitrary SQL queries facilitate database data collection (T1213.006) and stored data manipulation (T1565.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-57765Same product: Wangl1989 Mysiteforme
CVE-2024-57763Same product: Wangl1989 Mysiteforme
CVE-2024-57762Same product: Wangl1989 Mysiteforme
CVE-2024-13136Same product: Wangl1989 Mysiteforme
CVE-2024-13138Same product: Wangl1989 Mysiteforme
CVE-2024-57766Same product: Wangl1989 Mysiteforme
CVE-2024-13139Same product: Wangl1989 Mysiteforme
CVE-2024-57767Same product: Wangl1989 Mysiteforme
CVE-2024-57764Same product: Wangl1989 Mysiteforme
CVE-2019-25444Shared CWE-89

Affected Assets

wangl1989
mysiteforme
≤ 2025-01-01

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection attacks by validating and sanitizing untrusted user inputs before they are used in database queries.

SI-2 Flaw Remediation good match
prevent

Mandates timely patching and upgrading of vulnerable software components, such as mysiteforme to version 2025.01.1 or later, to remediate the specific SQL injection flaw.

RA-5 Vulnerability Monitoring and Scanning good match
prevent

Requires regular vulnerability scanning to identify and remediate SQL injection vulnerabilities like CVE-2025-26136 before exploitation.

References