CVE-2025-28056 rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component.

CriticalCVSS 9.8 EPSS 0.46%

Published: 2025-05-13 01:44 (approximate time: when CVE Radar first recorded it)
Updated: 2026-06-17 12:04
Exploit status: No public exploit known

Description

rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component.

Product	Affected versions	Fixed in
ruifang-tech rebuild	>= 3.9.0, <= 3.9.3	No fix listed

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation probability, 30 days): 0.46% (percentile 40.1)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.