Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Cozy Vision SMS Alert may let attackers change database

CVE-2025-47682 · published 1 year ago
Summary

The SMS Alert Order Notifications feature can be tricked into executing unintended database commands, which could let a malicious user view, modify, or delete information. This risk exists in versions up to 3.8.1. Update to a newer version or apply the vendor’s patch and ensure input is properly checked before it reaches the database.

What to do
  • Update cozyvision sms_alert_order_notifications to version 3.8.2 or later.
Affected software
VendorProductAffected versions
cozyvision sms_alert_order_notifications < 3.8.2
cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:free:wordpress:*:*
Original advisory text
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS...
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published12 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-47682 · NVD
CVE-2025-47682 · OSV
Track software like this
Free during beta