CVE-2025-52390

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. The application directly concatenates user-supplied input (`$search_word`) into SQL queries without sanitization, allowing attackers to manipulate the SQL logic and potentially extract sensitive information or escalate their privileges.

Published 2025-08-01. Last modified 2026-06-17.