CVE-2025-5631 is a high severity SQL injection flaw (CVSS 7.3) in the code-projects Content Management System and News-Buzz (anirbandutta9) 1.0. It is reachable over the network and needs no account. No fixed version is named in the record, so isolate the product, restrict access and check the vendor for an update.
What's affected
The record lists the code-projects Content Management System and News-Buzz (anirbandutta9) 1.0. The vulnerable code is the file /publicposts.php, and the argument named post is the one that is not handled safely.
The NVD description was published on 2025-06-05. NVD rates it HIGH with a base score of 7.3. The vector shows attack complexity low, no user interaction, and impact of confidentiality low, integrity low, availability low.
Fixed versions: not stated in the record or in the pages we could read. We cannot confirm a patched release, so the vendor's advisory page or support channel should be checked directly. Do not assume a later version number is safe without a vendor statement.
The record also says the exploit has been disclosed to the public and may be used. It is not marked as exploited in the wild: the CISA Known Exploited Vulnerabilities flag in the record is false.
How to check if you're exposed
First find out whether you run this software at all. Look for the application folder on your web servers and check the version shown in its footer, readme or release notes. Anything matching 1.0 should be treated as affected.
Then look at who can reach it. If the application answers on the public internet, assume it is exposed. A quick way to see whether the vulnerable page is in use is to search your web server access log for its name:
grep -c "publicposts.php" /var/log/apache2/access.log
Adjust the log path for your server. A high count from unfamiliar addresses, or requests with unusual characters in the parameter, deserves a closer look. If you own the source, open the file and check whether the query is built by joining strings or uses prepared statements:
grep -rn "mysqli_query\|->query(" ./publicposts.php
What to do now
- Take the code-projects Content Management System and News-Buzz (anirbandutta9) off the public internet, or put it behind a VPN or an allowlist, while you work out a longer term answer.
- Check the vendor or project page for a fixed release. None is named in the record, so confirm with the source rather than guessing.
- If you own the code, replace string built queries in the affected file with prepared statements and parameter binding, and validate input types.
- Run the database account used by the application with the fewest rights that work. It should not own the schema or read unrelated tables.
- Search access and database logs for odd requests to the vulnerable page, and rotate any credentials stored in the database if you find signs of misuse.
- Consider replacing the application. Small sample style PHP projects rarely receive regular security maintenance.
Why it matters
This is SQL injection. The weakness class is covered by CWE-74 (injection, where input is passed to a downstream interpreter without being neutralised); CWE-89 (SQL injection). The application takes a value from the request and builds a database query from it without keeping data and query structure apart. Someone who controls that value can change what the query does.
The vector says no account is needed, so anyone who can reach the page can try it, even though the path suggests an admin area. The impact scores are confidentiality low, integrity low, availability low. In practice that means the data in the database is the thing at stake, and for some applications also the integrity of what the application shows to users. Because the record says a proof of concept is public, the effort to try it is low even though nothing here is marked as exploited in the wild.
These small business applications also tend to share patterns. When one page in a codebase builds queries by joining strings, others often do too, and the record itself notes in several cases that other parameters might be affected. Fixing one parameter and calling it done is not enough.
Quick check
Is there a patched version?
The record does not name one. Check the vendor or project page and treat any claim of a fix as unconfirmed until the source states it.
Is this being exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability. It does say a public exploit exists, so do not treat that as safety.
Sources
Check your own dependencies with the free in-browser scan at gold.safeguard.sh/scan. It reads manifests you give it, so it will not see a router or a standalone server, but it is a quick way to cover the code you ship.
Last reviewed: 18 October 2026.
