CVE-2017-11174: Xoops

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.

Affected products

• Xoops Xoops: version 2.5.8.1 only

Published 2017-07-12. Last modified 2026-06-17.