CVE-2025-8117highCWE-909

CVE-2025-8117: falha de alta gravidade em Polska Akademia Dostępności PAD CMS

Account Takeover via Reset Password Functionality in PAD CMS

Publicada em

Seguir esta CVE+ Monitorar PAD CMS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.3%
PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Polska Akademia Dostępności · PAD CMS
CVEs relacionadas — Polska Akademia Dostępności PAD CMS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-7065CRITICALRemote Code Execution via Unrestricted File Upload in PAD CMSEPSS 0.6%CVE-2025-7063CRITICALRemote Code Execution via Unrestricted File Upload in PAD CMSEPSS 0.6%CVE-2025-8120CRITICALRemote Code Execution via Unrestricted File Upload in PAD CMSEPSS 0.6%CVE-2025-8122HIGHBlind SQL Injection in PAD CMSEPSS 0.3%CVE-2025-8121HIGHBlind SQL Injection in PAD CMSEPSS 0.3%CVE-2025-8116MEDIUMReflected XSS in PAD CMSEPSS 0.2%