Widzialni Pad_cms
9 CVEs affecting Widzialni Pad_cms. Latest disclosed: 2025-09-30. Critical: 3, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8120 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type… |
CVE-2025-7065 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type… |
CVE-2025-7063 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type… |
CVE-2025-8122 | High | 8.8 | 2025-09-30 | Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects… |
CVE-2025-8121 | High | 8.8 | 2025-09-30 | Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects… |
CVE-2025-8117 | High | 7.5 | 2025-09-30 | PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality… |
CVE-2025-8118 | Medium | 6.5 | 2025-09-30 | PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout… |
CVE-2025-8116 | Medium | 6.1 | 2025-09-30 | PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary Java… |
CVE-2025-8119 | Medium | 4.3 | 2025-09-30 | PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the… |