PT-2025-30377 · Unknown+1 · Sanluan Publiccms+1

Zast.Ai · Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-7953

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sanluan PublicCMS versions up to 5.202506.a

Description A problematic vulnerability has been identified in Sanluan PublicCMS. The issue involves unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. Manipulation of the File argument results in an open redirect, potentially allowing remote attacks. The exploit for this issue has been publicly disclosed.

Recommendations Sanluan PublicCMS versions prior to 5.202506.a: Apply the patch named f1af17af004ca9345c6fe4d5936d87d008d26e75 to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-7953

Affected Products

Sanluan Publiccms

Pdf.Js

References · 11

• 🔥 https://github.com/sanluan/PublicCMS/issues/88 · Exploit
• https://github.com/sanluan/PublicCMS/commit/f1af17af004ca9345c6fe4d5936d87d008d26e75 · Patch
• https://osv.dev/vulnerability/CVE-2025-7953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7953 · Security Note
• https://vuldb.com/?id.317099 · Note
• https://t.me/cvetracker/28352 · Telegram Post
• https://vuldb.com/?submit.619279 · Note
• https://vuldb.com/?ctiid.317099 · Note
• https://t.me/cvenotify/129769 · Telegram Post
• https://t.me/CVEtracker/28352 · Telegram Post
• https://twitter.com/CVEnew/status/1947520172975108129 · Twitter Post