PT-2025-52618 · Couchcms · Couchcms

Hiro · Published 2025-12-22 · Updated 2025-12-31 · CVE-2025-15005

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CouchCMS versions up to 2.4

Description A security issue exists in CouchCMS related to the reCAPTCHA Handler component. The issue resides in an unknown function within the couch/config.example.php file. Manipulation of the arguments K RECAPTCHA SITE KEY and K RECAPTCHA SECRET KEY can lead to the use of a hard-coded cryptographic key. This attack can be launched remotely and is characterized by high complexity, though exploitability is considered difficult. The exploit for this issue has been publicly released and may be exploited. Reports indicate offensive activities targeting this vulnerability.

Recommendations Versions prior to 2.4 should be updated.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2025-15005

Affected Products

Couchcms

References · 13

• 🔥 https://note-hxlab.wetolink.com/share/jNNcrdrNyCvl · Exploit
• 🔥 https://note-hxlab.wetolink.com/share/jNNcrdrNyCvl#-span--strong-proof-of-concept---strong---span- · Exploit
• https://osv.dev/vulnerability/CVE-2025-15005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15005 · Security Note
• https://t.me/CVEtracker/40381 · Telegram Post
• https://vuldb.com/?submit.718998 · Note
• https://t.me/cveNotify/146480 · Telegram Post
• https://vuldb.com/?ctiid.337711 · Note
• https://t.me/cveNotify/147332 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002914489650254074 · Twitter Post
• https://vuldb.com/?id.337711 · Note
• https://twitter.com/vuldb/status/2003054199937114158 · Twitter Post
• https://twitter.com/CVEnew/status/2003198616844865649 · Twitter Post