SQL Injection Flaw in Ultimate PHP Board by PHP-Outburst
CVE-2025-61540

6.5MEDIUM

Key Information:

Vendor

PHP-Outburst

Status
Ultimate PHP Board
Vendor
CVE Published:
16 October 2025

What is CVE-2025-61540?

A vulnerability exists in Ultimate PHP Board 2.2.7 that allows attackers to exploit an SQL injection flaw through the username field in the 'lostpassword.php' script. This weakness could enable unauthorized individuals to execute arbitrary SQL commands, potentially compromising the integrity of the database and leading to unauthorized data access or manipulation. Websites running this version of the Ultimate PHP Board are strongly advised to implement security measures to mitigate the risk associated with this vulnerability.

References

https://github.com/PHP-Outburst/myUPB?tab=readme-ov-file
https://github.com/bugdotexe/Vulnerability-Research/tree/...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.