CVE-2025-50567

CRITICAL 10.0CVE-2025-50567 · Published 19/08/2025 · updated 05/07/2026

In short

CVE-2025-50567 is a CRITICAL (CVSS 10.0) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 50.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code execution.

References

rahulhoysala/security-research
in.linkedin.com/in/rahul-hoysala-221a26341

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free