CVE-2025-56556
CVE-2025-56556 is a low-severity vulnerability in Intelliants Subrion Cms with a CVSS 3.x base score of 3.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-566.
Key facts
- Severity: Low (CVSS 3.x base score 3.8)
- EPSS exploit prediction: 0% (8th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-28990
- Weakness: CWE-566
- Affected product: Intelliants Subrion Cms
- Published:
- Last modified:
Description
An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the context of the SQL query tool.
Frequently asked questions
- What is CVE-2025-56556?
- An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the context of the SQL query tool.
- How severe is CVE-2025-56556?
- CVE-2025-56556 has a CVSS 3.x base score of 3.8, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2025-56556 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-56556?
- CVE-2025-56556 affects Intelliants Subrion Cms. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-56556?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-56556 have an EU (EUVD) identifier?
- Yes. CVE-2025-56556 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-28990.
- When was CVE-2025-56556 published?
- CVE-2025-56556 was published on 2025-09-11 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:intelliants:subrion_cms:4.2.1:*:*:*:*:*:*:*
More vulnerabilities in Intelliants Subrion Cms
- CVE-2017-11445 — Critical (CVSS 9.8): Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.
- CVE-2017-11444 — Critical (CVSS 9.8): Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
- CVE-2017-6013 — Critical (CVSS 9.8): Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.
- CVE-2021-43464 — High (CVSS 8.8): A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when…
- CVE-2020-18326 — High (CVSS 8.8): Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator…
- CVE-2019-7357 — High (CVSS 8.8): Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.
All CVEs affecting Intelliants Subrion Cms →
Other CWE-566 vulnerabilities
- CVE-2025-9953 — Critical (CVSS 9.8): Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting…
- CVE-2014-0808 — Critical (CVSS 9.1): Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems…
- CVE-2025-30369 — Low (CVSS 2.7): Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed…
- CVE-2025-30368 — Low (CVSS 2.7): Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be…