CVE-2018-25209: Sourceforge Openbiz Cubi Lite

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.

Affected products

Published 2026-03-26. Last modified 2026-06-17.