CVE-2025-52122

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-1336

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-52139.8A vulnerability was found in projectworlds Responsive E-Learning System 1.0. It has been declared as critical. Affected by this vulnerabilit CVE-2025-521305.4File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticate CVE-2025-521316.4The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.CVE-2025-521326.4The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.CVE-2025-521336.4The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.CVE-2025-521363.0In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is t CVE-2025-52149.8A vulnerability was found in Kashipara Responsive Online Learing Platform 1.0. It has been rated as critical. Affected by this issue is some CVE-2025-52159.8A vulnerability classified as critical has been found in D-Link DCS-5020L 1.01_B2. This affects the function websReadEvent of the file /rame CVE-2025-521598.8Hardcoded credentials in default configuration of PPress 0.0.9.CVE-2025-52169.8A vulnerability classified as critical was found in PHPGurukul Student Record System 3.20. This vulnerability affects unknown code of the fi CVE-2025-521619.8Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-521626.5agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint.