CVE-2025-56430

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the deleteDirectory function.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/fearlessgeekmedia/FearlessCMS/issues/36Exploit, Issue Tracking
https://github.com/fearlessgeekmedia/FearlessCMS/issues/36Exploit, Issue Tracking

Timeline

Published: Dec 10, 2025
Last modified: Nov 4, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-564317.5Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th CVE-2025-564326.1A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaSc CVE-2025-564355.3SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and CVE-2025-564386.8An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers CVE-2025-56442.5A vulnerability, which was classified as problematic, has been found in Radare2 5.9.9. Affected by this issue is the function r_cons_flush i CVE-2025-564479.8TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.CVE-2025-564486.8The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The CVE-2025-564498.2A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling CVE-2025-56452.5A vulnerability, which was classified as problematic, was found in Radare2 5.9.9. This affects the function r_cons_pal_init in the library /CVE-2025-564506.5Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/sel CVE-2025-564516.1Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main CVE-2025-56462.5A vulnerability has been found in Radare2 5.9.9 and classified as problematic. This vulnerability affects the function r_cons_rainbow_free i