Is CVE-2018-25420 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25420 being exploited in the wild.

How severe is CVE-2018-25420?

High severity, with a CVSS score of 8.2, published 30 May 2026.

Is there a fix for CVE-2018-25420?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2018-25420 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2018-25420?

Check whether you run Hayinfx AiOPMSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25420: AiOPMSD SQL injection in multiple PHP components

CVE-2018-25420 · Severity: high · CVSS 8.2 · Published 2026-05-30

AiOPMSD is a PHP-based script used to create and manage online movie streaming and download websites. A security flaw in the software allows unauthorized individuals to access the underlying database without a password. This could lead to the theft of sensitive information, including user credentials and database configuration details, potentially compromising the entire website and its users.

Vendors: Hayinfx.

Quick answers

Is CVE-2018-25420 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25420 being exploited in the wild.
How severe is CVE-2018-25420?: High severity, with a CVSS score of 8.2, published 30 May 2026.
Which products and versions are affected?: Hayinfx AiOPMSD 1.0.0 Final.
Is there a fix for CVE-2018-25420?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-25420 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2018-25420?: Check whether you run Hayinfx AiOPMSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 due to improper neutralization of special elements in several PHP components. Unauthenticated attackers can exploit this by sending crafted GET requests containing malicious SQL payloads to parameters such as 'id' in watch.php, 'q' in search.php, and others including actor.php, director.php, and genre.php. Successful exploitation allows for the extraction of sensitive data from the MySQL database, including database names, versions, and user information. The vulnerability is caused by a lack of input sanitization before passing user-supplied data into SQL queries. No official patch is currently documented for this legacy software.

Affected products

hayinfx AiOPMSD (All in One pack Online Movie Streaming Download) 1.0.0 Final

Timeline

2017-09-05: other: Last software update (Final version build 4) released
2018-10-24: disclosed: Exploit code published on Exploit-DB
2026-05-30: advisory: CVE-2018-25420 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.