High – 7.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

PT-2025-118: UNION-based SQL injection in MentionsPlugin for FosWiki

Error type:

  • CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Vulnerability vector:

  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
  • Severity (CVSSv4.0): 7.2 (High)

Description:

The vulnerability was identified in MentionsPlugin for FosWiki 2.1.9.

The vulnerability can be exploited due to insufficient validation of user input. This allows an attacker to inject arbitrary SQL statements and thereby modify the logic of database queries.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 24.09.2025

Recommendations:

Additional information: 

Researcher: Evgeny Kopytin (Positive Technologies)

Identifiers:

CVE registration in progress

BDU:2025-11650

Vendor:

FosWiki

Vulnerable product:

MentionsPlugin for FosWiki

Vulnerable versions:

MentionsPlugin < 1.30