PT-2025-49587 · Unknown · Azuriom Cms

Published 2025-12-08 · Updated 2025-12-09 · CVE-2025-65271

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azuriom CMS versions prior to 1.2.7

Description A client-side template injection (CSTI) issue exists in the Azuriom CMS admin dashboard. A low-privilege user can execute arbitrary template code within the context of an administrator's session. This is possible through plugins or dashboard components that render untrusted user input, potentially leading to privilege escalation. The vulnerable components render untrusted user input without proper sanitization.

Recommendations Update to Azuriom CMS version 1.2.7 or later.

Exploit

Fix

LPE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-65271

Affected Products

Azuriom Cms

References · 8

• 🔥 https://github.com/1337Skid/CVE-2025-65271 · Exploit
• https://github.com/Azuriom/Azuriom/commit/0289175547319add814dcb526e8ba034f1ebc3ec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-65271 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65271 · Vendor Advisory
• https://github.com/Azuriom/Azuriom · Note
• https://t.me/cveNotify/145252 · Telegram Post
• https://twitter.com/CVEnew/status/1998099351881814355 · Twitter Post
• https://t.me/CVEtracker/39153 · Telegram Post