CVE-2025-13782

Name of the Vulnerable Software and Affected Versions taosir WTCMS versions prior to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665

Description A flaw exists in taosir WTCMS related to the delete function within the SlideController.class.php file of the SlideController component. Manipulation of the ids argument can lead to a SQL injection. Remote exploitation is possible, and a public exploit is available. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions prior to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665 should be updated. As a temporary workaround, consider restricting access to the SlideController component or disabling the delete function until a patch is available.