A vulnerability, which was classified as critical, was found in JIZHICMS up to 2.5.5. The affected element is the function
deleteAll/findAll/delete of the file /index.php/admins/Comment/deleteAll.html of the component Batch Delete Comments. Executing manipulation can lead to sql injection.
This vulnerability is tracked as CVE-2025-14012. The attack can be launched remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
