PT-2025-48382 · Unknown · Taosir Wtcms

St1Tch · Published 2025-11-30 · Updated 2025-11-30 · CVE-2025-13782

Positive Technologies · (AI Summary)

CVSS v2.0

7.5

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions taosir WTCMS versions prior to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665

Description A flaw exists in the

delete

function within the

SlideController.class.php

file of the SlideController component. Manipulation of the

ids

argument can lead to SQL injection. Remote exploitation is possible. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Versions prior to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665 should be updated. As a temporary workaround, consider restricting access to the

SlideController

component or disabling the

delete

function until a patch is available.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2025-13782

Affected Products

Taosir Wtcms

References · 6

• 🔥 https://yuque.com/shangu-vvuup/ydpg69/amhlbdhkw0pgt44g?singleDoc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13782 · Security Note
• https://vuldb.com/?id.333786 · Note
• https://vuldb.com/?submit.688837 · Note
• https://vuldb.com/?ctiid.333786 · Note
• https://twitter.com/CVEnew/status/1994981184812503312 · Twitter Post