PT-2025-31863 · Unknown · Unisite Cms

Emrullah Baha Yılmaz + 2 · Published 2025-08-04 · Updated 2025-08-04 · CVE-2025-50754

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unisite CMS version 5.0

Description Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker is rendered in the admin panel when viewed by an administrator. This allows attackers to hijack the admin session and, by leveraging the template editor, upload and execute a PHP web shell on the server, leading to full remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-50754

Affected Products

Unisite Cms

References · 6

• 🔥 https://github.com/furk4nyildiz/CVE-2025-50754-PoC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50754 · Security Note
• https://imgur.com/a/rwfMlyq · Note
• https://tataxon.uz · Note
• https://twitter.com/CVEnew/status/1952473878875263453 · Twitter Post
• https://t.me/CVEtracker/29128 · Telegram Post