CVE-2018-25176 HIGH

CVE-2018-25176: Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload

Vendor Demo
Product Alive Parish
Weakness CWE-352 · CSRF
Published March 6, 2026
Last update March 9, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the key parameter in the search endpoint. Attackers can also upload arbitrary files via the person photo upload functionality to the images/uploaded directory for remote code execution.

Key dates

02Disclosure timeline

March 6, 2026 CVE published
March 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23559 WordPress MemeOne plugin <= 2.0.5 - CSRF to Stored XSS vulnerability CVE-2024-54352 WordPress Sogrid plugin <= 1.5.2 - CSRF to Privilege Escalation vulnerability CVE-2023-27623 WordPress WP Page Numbers Plugin <= 0.5 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2025-53311 WordPress Navayan Subscribe plugin <= 1.13 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2025-31908 WordPress JSON Structuring Markup plugin <= 0.1 - CSRF to Stored XSS vulnerability