PT-2026-1007 · Phpems · Phpems

Byebyedoggy · Publicado 2026-01-01 · Atualizado 2026-01-01 · CVE-2025-15405

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPEMS versions up to 11.0

Description A cross-site request forgery condition exists in PHPEMS. The issue is triggered by manipulation of an unknown function and can be exploited remotely.

Recommendations Versions prior to 11.0 should be updated.

Exploit

Correção

CSRF

Missing Authorization

Enumeração de Fraquezas

CWE-352

CWE-862

Identificadores relacionados

CVE-2025-15405

Produtos afetados

Phpems

Referências · 10

• 🔥 https://byebydoggy.github.io/post/2025/1231-phpems-csrf-poc · Exploit
• https://twitter.com/CVEnew/status/2006861509188559268 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2006752967085441294 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-15405 · Aviso do Fabricante
• https://t.me/CVEtracker/41174 · Publicação no Telegram
• https://vuldb.com/?id.339325 · Nota
• https://vuldb.com/?ctiid.339325 · Nota
• https://vuldb.com/?submit.728314 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-15405 · Nota de Segurança
• https://t.me/cveNotify/147436 · Publicação no Telegram