CVE-2025-15422

HighCVSS 7.5/10Last modified Oct 7, 2026

Description

A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. This manipulation causes protection mechanism failure. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
EmpireSoft	EmpireCMS	8.0

References

https://note-hxlab.wetolink.com/share/0x74KEtzecFbExploit, Third Party Advisory
https://note-hxlab.wetolink.com/share/0x74KEtzecFb#-span--strong-proof-of-concept---strong---span-Exploit, Third Party Advisory
https://vuldb.com/?ctiid.339344Permissions Required, VDB Entry
https://vuldb.com/?id.339344Third Party Advisory, VDB Entry
https://vuldb.com/?submit.721344Third Party Advisory, VDB Entry
https://note-hxlab.wetolink.com/share/0x74KEtzecFbExploit, Third Party Advisory
https://note-hxlab.wetolink.com/share/0x74KEtzecFb#-span--strong-proof-of-concept---strong---span-Exploit, Third Party Advisory

Timeline

Published: Jan 2, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-154238.8A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect CVE-2025-154249.8A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the c CVE-2025-154259.8A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the co CVE-2025-154267.3A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/serv CVE-2025-154288.8A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This mani CVE-2025-154298.8A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /g CVE-2025-15434.3A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown process CVE-2025-154308.8A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerSha CVE-2025-154318.8A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a CVE-2025-154327.5A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function d CVE-2025-154336.8The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such CVE-2025-154349.8A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argu