PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://cert.pl/posts/2025/09/CVE-2025-7063 |
Configurations
No configuration.
History
30 Sep 2025, 11:37
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-30 11:37
Updated : 2025-10-02 19:12
NVD link : CVE-2025-8119
Mitre link : CVE-2025-8119
CVE.ORG link : CVE-2025-8119
JSON object : View
Products Affected
No product.
CWE
CWE-352
Cross-Site Request Forgery (CSRF)