PT-2025-48542 · Publiccms · Publiccms

Published 2025-12-01 · Updated 2025-12-02 · CVE-2025-65836

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PublicCMS version 5.202506.b

Description PublicCMS version 5.202506.b is susceptible to a Server-Side Request Forgery (SSRF) condition. This issue is located within the chat interface of the SimpleAiAdminController. SSRF occurs when an application makes requests to unintended locations, potentially exposing internal resources or allowing an attacker to perform actions on behalf of the server. The vulnerable component is the SimpleAiAdminController chat interface.

Recommendations Apply a fix for PublicCMS version 5.202506.b to address the SSRF issue in the SimpleAiAdminController chat interface.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-65836

Affected Products

Publiccms

References · 8

• 🔥 https://github.com/sanluan/PublicCMS/issues/99 · Exploit
• 🔥 https://github.com/Hyperkopite/PublicCMS_Vulns/blob/main/SSRF_1.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-65836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65836 · Security Note
• https://github.com/sanluan/PublicCMS · Note
• https://twitter.com/VulmonFeeds/status/1995735062147444760 · Twitter Post
• https://twitter.com/CVEnew/status/1995588284169552301 · Twitter Post
• https://t.me/CVEtracker/38575 · Telegram Post