External risk intelligence

DobryCMS SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-8536

DobryCMS is a content management system. Content management systems are commonly deployed as internet-facing web applications to serve public-facing websites, making them a typical target for external network access.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A SQL injection vulnerability in DobryCMS could allow unauthorized access and manipulation of data within the content management system. This type of flaw affects how user-provided input is handled, potentially exposing sensitive information or disrupting operations. The main concern is confirming if any instances of this software are actively used and exposed.

SQL injection flaw in content management software.
Matters if your organization uses DobryCMS.
Confirm relevance and identify potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to the language functionality of DobryCMS. If successful, this could allow them to manipulate database queries, potentially leading to unauthorized access to or modification of sensitive information. There is no information available on specific chaining or exploitation methods.

No authentication or special access required.
Malicious input to language features.
Unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in DobryCMS's language functionality could allow attackers to manipulate the application's database when supported by the advisory. This could potentially affect system data and alter service behavior.

System data and application integrity.
Through crafted language input.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in DobryCMS affects older branches and can be exploited via the network. The first step is to identify all instances of this software, determine their reachability and business criticality, and then locate the accountable owner. Following this, a risk-based remediation plan should be developed, potentially involving vendor coordination or temporary mitigation if immediate patching isn't feasible.

Identify accountable DobryCMS owners.
Verify system reachability and criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DobryCMS?

DobryCMS is a content management system used to build and manage websites. It provides a framework for organizing and publishing digital content, often serving as the backend engine for public-facing web pages and site features.

What is the vulnerability in CVE-2025-8536?

CVE-2025-8536 is a SQL injection vulnerability, categorized as CWE-89. This weakness means the software fails to properly clean user input before processing it. In this case, the flaw exists within the language functionality, allowing an attacker to inject malicious database commands.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted input specifically to the language features of the software. It does not require authentication or special user privileges to attempt. The vulnerability is restricted to older branches of the software; newer, updated versions are not inherently affected by this specific flaw.

Is my instance of DobryCMS at risk?

According to Halo Surface Signal, DobryCMS is typically used for internet-facing websites, making it highly accessible to external network traffic. If your instance is reachable from the internet, it is a potential target. Internal-only instances still require attention but are less likely to be reached by untrusted external sources.

What should I do if I run DobryCMS?

First, conduct an inventory to locate all active instances of the software and identify who is responsible for them. Verify if your deployments are running older, affected branches. Once identified, assess the business criticality of those systems to prioritize and plan your remediation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.