Vulnerability · Published Oct 22, 2025 · Assigned by GitHub_M

CVE-2025-62606my little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameter

High 8.8

In plain English

A high-severity SQL injection in mylittleforum from My-Little-Forum. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to version 2.5.12, an authenticated SQL injection vulnerability in the bookmark reordering feature allows any logged-in user to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 2.5.12.

Affected products (as reported)

Vendor	Product	Versions
My-Little-Forum	mylittleforum	< 2.5.12

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-m8hj-c6gr-6h6v x_refsource_CONFIRM
https://github.com/My-Little-Forum/mylittleforum/releases/tag/20251021.1 x_refsource_MISC