PT-2025-23613 · Phpcms · Phpcms

Dem0 · CVE-2025-5498 · Published 2025-06-03 · Updated 2026-01-20

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions slackero phpwcms versions 1.9.45 and earlier, slackero phpwcms versions 1.10.8 and earlier

Description A critical issue affects the function file get contents/is file of the file include/inc lib/content/cnt21.readform.inc.php in the Custom Source Tab component. The manipulation of the argument cpage custom leads to deserialization. This issue can be exploited remotely.

Recommendations For slackero phpwcms versions 1.9.45 and earlier, upgrade to version 1.9.46. For slackero phpwcms versions 1.10.8 and earlier, upgrade to version 1.10.9.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2025-5498

Affected Products

Phpcms

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5498.json · Exploit
• 🔥 https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23is_file.md · Exploit
• 🔥 https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23file_get_contents.md · Exploit
• https://github.com/slackero/phpwcms/releases/tag/v1.10.9 · Patch
• https://osv.dev/vulnerability/CVE-2025-5498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5498 · Security Note
• https://twitter.com/VulmonFeeds/status/1929919181308191147 · Twitter Post
• https://t.me/cveNotify/149290 · Telegram Post
• https://t.me/cvetracker/25277 · Telegram Post
• https://twitter.com/CVEnew/status/1929900443125068150 · Twitter Post
• https://vuldb.com/?ctiid.310913 · Note
• https://vuldb.com/?submit.578054 · Note
• https://vuldb.com/?id.310913 · Note
• https://vuldb.com/?submit.578055 · Note