SQL Injection Vulnerability in LambertGroup Apollo Software
CVE-2025-32245

7.1HIGH

Key Information:

Vendor

WordPress
Status
Featured Posts Scroll
Vendor
CVE Published:
16 May 2025

What is CVE-2025-32245?

A vulnerability in LambertGroup's Apollo software allows for improper neutralization of special elements within SQL commands, leading to SQL injection attacks. This flaw enables attackers to manipulate the database by executing unauthorized SQL queries. Versions of Apollo up to and including 3.6.3 are susceptible, requiring immediate attention to safeguard sensitive data and prevent potential exploitation.

Affected Version(s)

Featured Posts Scroll 0 <= 1.25

References

https://patchstack.com/database/Wordpress/Plugin/featured...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
.