PT-2025-27022 · Unknown · Juzawebcms

Cyber-Wo0Dy · Published 2025-06-26 · Updated 2025-06-27 · CVE-2025-6735

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: juzaweb CMS version 3.4.2

Description: A critical vulnerability has been found in juzaweb CMS, affecting an unknown function of the file /admin-cp/imports of the component Import Page. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations: As a temporary workaround, consider restricting access to the /admin-cp/imports functionality until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-6735

GHSA-RQ7X-CFMC-RQ3W

Affected Products

Juzawebcms

References · 13

• 🔥 https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_unprivileged_user_make_import.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-6735 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rq7x-cfmc-rq3w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6735 · Security Note
• https://github.com/juzaweb/cms · Note
• https://vuldb.com/?ctiid.314010 · Note
• https://t.me/cvetracker/27183 · Telegram Post
• https://twitter.com/transilienceai/status/1938447667371131179 · Twitter Post
• https://twitter.com/transilienceai/status/1938447664921629138 · Twitter Post
• https://vuldb.com/?submit.597778 · Note
• https://twitter.com/CVEnew/status/1938384542337012052 · Twitter Post
• https://t.me/cvenotify/126820 · Telegram Post
• https://vuldb.com/?id.314010 · Note