CVE-2025-8119

MEDIUM

Widzialni Pad Cms < 1.2.1 - CSRF

Title source: rule

Description

PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.

References (1)

[Third Party Advisory] https://cert.pl/posts/2025/09/CVE-2025-7063

Scores

CVSS v3 4.3

EPSS 0.0001

EPSS Percentile 2.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Classification

CWE

CWE-352

Status published

Affected Products (1)

widzialni/pad_cms < 1.2.1

Timeline

Published Sep 30, 2025

Tracked Since Feb 18, 2026