High severity · published Oct 22, 2025
CVE-2025-62606
my little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameter
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to version 2.5.12, an authenticated SQL injection vulnerability in the bookmark reordering feature allows any logged-in user to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 2.5.12.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
mylittleforum · My-Little-Forum
< 2.5.12 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62606
github.com
https://github.com/My-Little-Forum/mylittleforum/releases/tag/20251021.1
github.com
https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-m8hj-c6gr-6h6v
More from mylittleforum
9.1
CVE-2026-25923
Phar Deserialization leading to Arbitrary File Deletion in my little forum