CVE Intelligence
Analysis AI-assisted

CVE-2020-37110: 60CycleCMS 2.5.2 SQL Injection in news.php and common/lib.php

CVE-2020-37110 describes an SQL injection flaw in 60CycleCMS 2.5.2, located in news.php and common/lib.php, where unvalidated input can alter database queries. The NVD entry rates it critical with a CVSS 3.1 base score of 9.8, and VulnCheck lists a CVSS 4.0 score of 8.8. No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list this CVE.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37110 affects 60CycleCMS version 2.5.2. According to the record, the SQL injection flaw is located in news.php and common/lib.php, where unvalidated user input can influence database queries through parameters such as 'title'. The weakness is classified as CWE-89.

Impact

  • Attackers could potentially read database contents.
  • Attackers could potentially modify database contents.
  • The NVD CVSS 3.1 metrics in the record rate confidentiality, integrity and availability impact as high.

Affected products and versions

  • Product listed as Opensourcecms 60cyclecms.
  • Affected version listed: 2.5.2.
  • The record lists no other affected versions.

Exploitation status

The CISA KEV catalog does not list this CVE. The record includes an Exploit-DB reference, but its presence does not by itself confirm exploitation in the wild. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record lists no fixed version, so remediation status is unknown. Check the vendor page and the links below for updates.
  • If the product is in use, consider removing it or isolating it from untrusted networks until its status is clarified.
  • Maintainers of custom code should use parameterized queries and strict input validation for all query parameters.
  • Limit database account privileges to what the application needs.

Detection guidance

  • Review web server logs for unusual or malformed values in requests to news.php.
  • Watch for database errors returned to users or unexpected query behavior.
  • Monitor for unexpected changes in content tables.

Limitations of the available information

The NVD entry in the record has no CVSS 4.0 score, and the record has no EPSS score, SSVC data or fixed version. The VulnCheck advisory and the vendor page are tagged as broken links, so their current content could not be verified. Affected version coverage beyond 2.5.2 is unknown.

Frequently asked questions

Is CVE-2020-37110 known to be exploited?

The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted. The record includes an Exploit-DB reference, which signals public interest but does not prove attacks.

What should administrators do now?

The record provides no fixed version. Identify whether 60CycleCMS 2.5.2 is deployed, isolate it from untrusted networks where possible, and monitor vendor or community sources for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.