$ cve CVE-2025-22785 JSON

CVE-2025-22785

9.3

CRITICAL · CVSS 3.1 · EPSS 2.9% (pctl 87)

In your normal cycle

Critical by CVSS (9.3), but no sign of active exploitation.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.

Scoring

CVSS	9.3 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS	2.93% — more likely to be exploited than 87% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	none known
Published	2025-01-15
Last modified	2026-06-17

References

https://patchstack.com/database/Wordpress/Plugin/course-booking-system/vulnerability/wordpress-course-booking-system-plugin-6-0-5-sql-injection-vulnerability?_s_id=cve

→ the Explorer · watch your stack · NVD