PT-2025-53663

CVE-2025-15148

Published

2025-12-28

Updated

2026-10-13

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CmsEasy versions through 7.7.7

Description A flaw exists in CmsEasy that allows for code injection. The issue is located in the savetemp action function within the /lib/admin/template admin.php library of the Backend Template Management Page component. Manipulation of the content/tempdata argument can trigger the flaw, potentially allowing for remote code execution. The exploit for this issue has been published.

Recommendations Versions prior to 7.7.7 should be used.

Exploitability

Exploit

Fix

Impacts

Researchers

Vuldb

Yu22X

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')