VYPR
Get started
← All advisories
Critical severityGHSA Advisory· Published Oct 8, 2025· Updated Apr 15, 2026

CVE-2025-10351

CVE-2025-10351

Description

SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
melisplatform/melis-cmsPackagist
< 5.3.45.3.4

Affected products

1

Patches

1
42d36326d9f6

Fixed injection problem

https://github.com/melisplatform/melis-cmsCrisJan 16, 2025via ghsa
commit
1 file changed · +4 −0
  • src/Controller/PageEditionController.php+4 −0 modified
    @@ -367,6 +367,10 @@ public function getTinyTemplatesAction()
 		$success = 1;
 		$tinyTemplates = array();
 
+        if((is_null($idPage) || empty($idPage) || !is_numeric($idPage))){
+            return new JsonModel($tinyTemplates);
+        }
+
 		// No pageId, return empty array 
 		if (!empty($idPage))
 		{

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.