PT-2025-36538 · Unknown · Siemprecms

Drewbyte · Published 2025-09-09 · Updated 2025-09-14 · CVE-2025-10116

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SiempreCMS versions prior to 1.3.7

Description: A vulnerability was identified in SiempreCMS that allows for unrestricted file upload through manipulation of unknown code within the /docs/admin/file upload.php file. The attack can be launched remotely. The exploit is publicly available.

Recommendations: Update to a version prior to 1.3.7. As a temporary workaround, restrict access to the /docs/admin/file upload.php file.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-10116

Affected Products

Siemprecms

References · 9

• 🔥 https://github.com/drew-byte/SiempreCMS-File-Upload-Abuse/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10116 · Security Note
• https://vuldb.com/?id.323085 · Note
• https://t.me/cveNotify/134731 · Telegram Post
• https://twitter.com/cracbot/status/1967181584714572051 · Twitter Post
• https://twitter.com/CVEnew/status/1965244311982797237 · Twitter Post
• https://vuldb.com/?submit.645540 · Note
• https://vuldb.com/?ctiid.323085 · Note
• https://twitter.com/VulmonFeeds/status/1965336052664582162 · Twitter Post