CVE-2025-2043

MEDIUM

Pb-cms - Insecure Deserialization

Title source: rule

Description

A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

References (4)

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.298787

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.298787

[Broken Link] https://github.com/Jingyi-u/Pb-cms2/blob/main/README.md

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.513243

Scores

CVSS v3 4.7

EPSS 0.0023

EPSS Percentile 45.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Classification

CWE

CWE-502 CWE-20

Status published

Affected Products (1)

pb-cms_project/pb-cms

Timeline

Published Mar 06, 2025

Tracked Since Feb 18, 2026