CVE-2025-60790

MediumCVSS 6.5/10Last modified Oct 27, 2026

Description

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/NomanProdhan/security-vulnerability-research/tree/master/CVE-2025-60790Exploit, Third Party Advisory
https://github.com/processwire/processwire-issues/issues/2120Exploit, Issue Tracking, Vendor Advisory
https://github.com/processwire/processwire-issues/issues/2120Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Oct 21, 2025
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-607916.2Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bou CVE-2025-607946.5Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/use CVE-2025-607966.1phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input fr CVE-2025-607976.5phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-s CVE-2025-607986.5phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled inpu CVE-2025-607996.1phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthori CVE-2025-60808.8The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to,CVE-2025-608007.5Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive informa CVE-2025-608018.2jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function CVE-2025-608039.8Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the comp CVE-2025-608057.5An issue was discovered in BESSystem BES Application Server thru 9.5.x allowing unauthorized attackers to gain sensitive information via the CVE-2025-60816.8Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacke