CVE-2025-14731

Katalog CVE

CVSS 7.2 · High EPSS 0,45%

Kerentanan Incomplete Filtering of Special Elements pada ctcms project ctcms. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser.php of the component Frontend/Template Management Module. This manipulation causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Rincian

Terbit di NVD

16 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-791: Incomplete Filtering of Special Elements
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN exploit · advisory pihak ketiga
• https://note-hxlab.wetolink.com/share/U6cnRoRfn09r exploit · advisory pihak ketiga
• https://vuldb.com/?id.336488 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707106 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707107 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.336488 permissions required · vdb entry