CVE-2025-8117

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-909

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-81186.5PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attem CVE-2025-81194.3PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which w CVE-2025-81209.8Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to uploa CVE-2025-81218.8Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks.CVE-2025-81228.8Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks.CVE-2025-81238.8A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been classified as critical. Affected is an unknown function of the file /CVE-2025-81248.8A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been declared as critical. Affected by this vulnerability is an unknown fu CVE-2025-81259.8A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been rated as critical. Affected by this issue is some unknown functionali CVE-2025-81268.8A vulnerability classified as critical has been found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/user CVE-2025-81278.8A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. This vulnerability affects unknown code of the file /syste CVE-2025-81286.3A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a65228476290949e0413de48f7fbe98. This issue CVE-2025-81296.1A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/r