CVE-2018-25362

Description

Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the userid parameter. Attackers can submit union-based or time-based blind SQL injection payloads to extract sensitive database information including usernames, passwords, and database credentials.

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

8.2 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Effective score

8.2 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2018-25362

Linked Threat

CVE-2018-25362 — CVE-2018-25362

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-25 15:16:18 UTC

NVD last modified

2026-07-23 17:10:00 UTC

NVD CVSS v3.1

8.2 / 10 HIGH source: disclosure@vulncheck.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability subscore

3.9 / 10

Impact subscore

4.2 / 10

EPSS score

0.0031 (probability of exploitation in next 30 days)

EPSS percentile

23.17% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-89 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2018-21882

Assigner

VulnCheck

Published

May 25, 2026, 2:15:09 PM

Updated

May 26, 2026, 3:22:40 PM

EUVD base score (CVSS 4.0)

8.8 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EUVD-reported EPSS

0.3100

Vendors

Fyffe

Products

PHP-Twitter-Clone (1.0)

Aliases

GHSA-4wjh-3728-4qgm

ENISA description: Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the userid parameter. Attackers can submit union-based or time-based blind SQL injection payloads to extract sensitive database information including usernames, passwords, and database credentials.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/Fyffe/PHP-Twitter-Clone/ tenable:github.com
• https://nvd.nist.gov/vuln/detail/CVE-2018-25362 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2018-25362 tenable:www.cve.org
• https://www.exploit-db.com/exploits/45230 tenable:www.exploit-db.com
• https://www.first.org/epss/ tenable:www.first.org
• https://www.vulncheck.com/advisories/twitter-clone-1-sql-injection-via-follow-php tenable:www.vulncheck.com

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• FIX Trading Community
  web:fixtrading.org

  The FIX Trading Community is the independent, non‑profit, industry‑driven standards body at the heart of global trading, and the custodian of the FIX Protocol—the world's leading standard for real‑time electronic trading.

  2026-06-19 02:25 UTC
• GitHub - shiversoftdev/t7patch: A new and improved community patch for ...
  web:github.com

  A new and improved community patch for BO3. . Contribute to shiversoftdev/t7patch development by creating an account on GitHub.

  2026-06-19 02:25 UTC
• Security Update Guide - Microsoft Security Response Center
  web:msrc.microsoft.com

  Access Microsoft Security Response Center's guide to address vulnerabilities, manage security risks, and keep your systems protected with the latest updates.

  2026-06-19 02:25 UTC
• KB4072698: Windows Server and Azure Stack HCI guidance to protect ...
  web:support.microsoft.com

  Mitigation settings for Windows Server and Azure Stack HCI Security advisories (ADVs) and CVEs provide information provide information about the risk that is posed by these vulnerabilities. They also help you identify the vulnerabilities and identify the default state of mitigations for Windows Server systems.

  2026-06-19 02:25 UTC
• KB4073757: Protect Windows devices against silicon-based ...
  web:support.microsoft.com

  Learn more how to protect your Windows devices against silicon-based microarchitectural and speculative execution side-channel vulnerabilities

  2026-06-19 02:25 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-06-19 02:25 UTC
• Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find
  web:www.cvefind.com

  CVE Find is a real-time vulnerability database indexing 358 438 security flaws ( CVE ) from MITRE, NVD, CISA KEV, CWE and CAPEC. 961 new CVEs were published in the last 7 days. Data aggregated from: MITRE Corporation ( CVE , CWE, CAPEC), National Vulnerability Database - NIST (NVD), CISA Known Exploited Vulnerabilities (KEV), FIRST (EPSS).

  2026-06-19 02:25 UTC
• Oracle Critical Patch Update Advisory - January 2026
  web:www.oracle.com

  Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...

  2026-06-19 02:25 UTC
• patch.moe - Age Verification
  web:www.patch.moe

  Age Verification Are you 18 years or older? YES NO

  2026-06-19 02:25 UTC
• PATCH Career Institute
  web:www.patchcareerinstitute.com

  P.A.T.C.H . Career Institute's mission is to provide quality training to students in the medical and vocational field. Our primary focus is to provide affordable, and competitive educational training for low to moderate income students.

  2026-06-19 02:25 UTC

Only Available for Registered Users. Sign in to view.