CVE Feed

    Dashboard / CVE / CVE-2025-8120

    CVE-2025-8120

    Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.

    Published:Sep 30, 2025
    Last Modified:Nov 26, 2025
    EPS:Sep 30, 2025
    EPSS Score:0.00299
    CVSS Score:9.8

    Affected Products

    Vendor
    Pad
    Product
    Pad Cms
    Vendor
    Widzialni
    Product
    Pad Cms

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2025-8122 (CVSS 8.7) — Improper neutralization of input provided by an authorized user in article positioning functionality allows fo…
    CVE-2025-8121 (CVSS 8.7) — Improper neutralization of input provided by an authorized user in article positioning functionality allows fo…
    CVE-2025-8119 (CVSS 5.1) — PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can …
    CVE-2025-8118 (CVSS 6.9) — PAD CMS implements weak client-side brute-force protection by utilizing two cookies:  login_count and login_ti…
    CVE-2025-8117 (CVSS 8.7) — PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any u…
    CVE-2025-8116 (CVSS 5.1) — PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft…
    CVE-2025-7065 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenti…
    CVE-2025-7063 (CVSS 10) — Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthentic…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High