PT-2025-54436

CVE-2025-15394

Published

2025-12-31

Updated

2026-09-23

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iCMS versions up to 8.0.0

Description A code injection issue exists in iCMS due to manipulation of the config argument within the Save function located in the file app/config/ConfigAdmincp.php, part of the POST Parameter Handler component. This allows for remote attacks. The exploit is publicly available, and the vendor was notified but did not respond.

Recommendations Versions prior to 8.0.0 should be updated.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers