PT-2025-23463 · Unknown · Juzawebcms

Cyber-Wo0Dy · Published 2025-06-02 · Updated 2025-08-18 · CVE-2025-5429

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions juzaweb CMS versions up to 3.4.2

Description A critical issue was found in the Plugins Page component, specifically affecting the /admin-cp/plugin/install file. This leads to improper access controls, allowing for remote attacks. The issue has been publicly disclosed, and the vendor was notified but did not respond.

Recommendations For juzaweb CMS versions up to 3.4.2, consider restricting access to the /admin-cp/plugin/install file until a fix is available. As a temporary workaround, review and tighten access controls to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-5429

Affected Products

Juzawebcms

References · 10

• 🔥 https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_unprivileged_user_list_install_plugins.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-5429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5429 · Security Note
• https://twitter.com/CVEnew/status/1929400778831053063 · Twitter Post
• https://reddit.com/r/CyberDudeBivash/comments/1mtntya/daily_cve_roundup_august_18_2025_by · Reddit Post
• https://vuldb.com/?id.310762 · Note
• https://vuldb.com/?submit.584057 · Note
• https://vuldb.com/?ctiid.310762 · Note
• https://t.me/cvetracker/25135 · Telegram Post
• https://t.me/cvenotify/124301 · Telegram Post