High severity8.8OSV Advisory· Published Oct 22, 2025· Updated Apr 15, 2026

CVE-2025-62606

Description

my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to version 2.5.12, an authenticated SQL injection vulnerability in the bookmark reordering feature allows any logged-in user to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 2.5.12.

Affected products

My Little Forum/MylittleforumOSV
Range: 2.3.99.3, 2.4, 2.4.1, …

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/My-Little-Forum/mylittleforum/releases/tag/20251021.1nvd
github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-m8hj-c6gr-6h6vnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000