PT-2026-1042

CVE-2025-15423

Published

2026-01-02

Updated

2026-10-01

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EmpireSoft EmpireCMS versions prior to 8.0

Description A flaw exists in EmpireSoft EmpireCMS that allows for unrestricted file uploads. This issue is located in the CheckSaveTranFiletype function within the e/class/connect.php file. Successful exploitation may occur remotely. The details of the issue have been publicly disclosed. The vendor was informed of this disclosure but did not provide a response.

Recommendations Update to a version of EmpireSoft EmpireCMS newer than 8.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Gets

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-434: Unrestricted Upload of File with Dangerous Type