CVE Feed

    Dashboard / CVE / CVE-2025-8119

    CVE-2025-8119

    PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.

    Published:Sep 30, 2025
    Last Modified:Nov 26, 2025
    EPS:Sep 30, 2025
    EPSS Score:0.00027
    CVSS Score:4.3

    Affected Products

    Vendor
    Pad
    Product
    Pad Cms
    Vendor
    Widzialni
    Product
    Pad Cms

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-8122 (CVSS 8.7) — Improper neutralization of input provided by an authorized user in article positioning functionality allows fo…
    CVE-2025-8121 (CVSS 8.7) — Improper neutralization of input provided by an authorized user in article positioning functionality allows fo…
    CVE-2025-8120 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenti…
    CVE-2025-8118 (CVSS 6.9) — PAD CMS implements weak client-side brute-force protection by utilizing two cookies:  login_count and login_ti…
    CVE-2025-8117 (CVSS 8.7) — PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any u…
    CVE-2025-8116 (CVSS 5.1) — PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft…
    CVE-2025-7065 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenti…
    CVE-2025-7063 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthentic…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High