CVE-2013-3727: Kasseler-CMS

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

Affected products

• Kasseler-CMS Kasseler-CMS: up to and including 2

Published 2014-03-13. Last modified 2026-06-16.