PT-2025-51320 · Unknown · Ctcms Content Management System

Airrudder · Published 2025-12-15 · Updated 2025-12-21 · CVE-2025-14730

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CTCMS Content Management System versions up to 2.1.2

Description A security flaw exists in CTCMS Content Management System. The issue resides in an unknown function within the /ctcms/libs/Ct Config.php library of the Backend System Configuration Module. Manipulation of the Cj Add/Cj Edit argument can lead to code injection, and the attack can be carried out remotely. The exploit for this issue has been publicly released and may be exploited.

Recommendations Versions prior to 2.1.2 should be updated.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2025-14730

Affected Products

Ctcms Content Management System

References · 9

• 🔥 https://note-hxlab.wetolink.com/share/87u6f02Gho0K · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14730 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14730 · Vendor Advisory
• https://vuldb.com/?submit.707105 · Note
• https://vuldb.com/?id.336487 · Note
• https://twitter.com/CVEnew/status/2002857353478344936 · Twitter Post
• https://t.me/CVEtracker/39873 · Telegram Post
• https://vuldb.com/?ctiid.336487 · Note
• https://t.me/cveNotify/145873 · Telegram Post