CVE-2025-2978

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/upload/?&CKEditor=container&CKEditorFuncNum=1 of the component Article Publishing Page. The manipulation of the argument Upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-297805.8Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) schemeCVE-2025-297816.5The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load CVE-2025-297825.4WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docCVE-2025-297839.0vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deseriCVE-2025-297847.5NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requCVE-2025-297857.5quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 releasCVE-2025-297867.5Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unboundeCVE-2025-297877.3`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versioCVE-2025-297886.5The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions prior to 1.6.1, 1.7.CVE-2025-297897.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulneraCVE-2025-29795.4A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregistCVE-2025-297905.4Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This