Home / Vulnerability Intelligence / CVE-2018-25188

CVE-2018-25188 - Vulnerability Analysis

HighCVSS: 8.2

Last Updated: March 6, 2026

Webiness Inventory - SQL Injection

Published: March 6, 2026Updated: March 6, 2026Remote Exploitable

Overview

Webiness Inventory 2.3 contains an sql injection caused by unsanitized input in the order parameter in WsModelGrid.php, letting unauthenticated attackers execute arbitrary SQL queries and extract sensitive database information.

Severity & Score

Severity: High

CVSS Score: 8.2

Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information, compromising data confidentiality.

Mitigation

Update to the latest version of Webiness Inventory.

References

https://www.exploit-db.com/exploits/45843
https://www.vulncheck.com/advisories/webiness-inventory-sql-injection-via-wsmodelgridphp

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2018-25188
Severity: High
CVSS Score: 8.2
Type: sql_injection
Status: new

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N