CVE-2025-8117

HIGH

widzialni pad_cms < 1.2.1 - Unauthenticated Password Reset Parameter Initialization Flaw

Title source: llm
STIX 2.1

Description

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0025
EPSS Percentile 15.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-909
Status published
Products (1)
widzialni/pad_cms < 1.2.1
Published Sep 30, 2025
Tracked Since Feb 18, 2026