CVE-2025-65877

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Dec 2, 2025

CISA due date

—

The record

Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms.service.ContentService#findPage. The parameter is concatenated directly into a dynamic SQL query without sanitization or prepared statements, enabling attackers to read sensitive data from the database.

Affected packages

Ecosystem	Package	Introduced	Fixed