CVE-2025-15423

MEDIUM

EmpireCMS < 8.0 - Unrestricted File Upload via CheckSaveTranFiletype Function

Title source: llm
STIX 2.1

Description

A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.339345
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.339345
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.721346
Exploit, Third Party Advisory related
https://note-hxlab.wetolink.com/share/28QXRLje7Uz1

Scores

CVSS v3 6.3
EPSS 0.0031
EPSS Percentile 22.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-284 CWE-434
Status published
Products (1)
phome/empirecms < 8.0
Published Jan 02, 2026
Tracked Since Feb 18, 2026