CVE Feed

    Dashboard / CVE / CVE-2025-8118

    CVE-2025-8118

    PAD CMS implements weak client-side brute-force protection by utilizing two cookies:  login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.

    Published:Sep 30, 2025
    Last Modified:Nov 26, 2025
    EPS:Sep 30, 2025
    EPSS Score:0.00059
    CVSS Score:6.5

    Affected Products

    Vendor
    Pad
    Product
    Pad Cms
    Vendor
    Widzialni
    Product
    Pad Cms

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-8122 (CVSS 8.7) — Improper neutralization of input provided by an authorized user in article positioning functionality allows fo…
    CVE-2025-8121 (CVSS 8.7) — Improper neutralization of input provided by an authorized user in article positioning functionality allows fo…
    CVE-2025-8120 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenti…
    CVE-2025-8119 (CVSS 5.1) — PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can …
    CVE-2025-8117 (CVSS 8.7) — PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any u…
    CVE-2025-8116 (CVSS 5.1) — PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft…
    CVE-2025-7065 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenti…
    CVE-2025-7063 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthentic…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High