PT-2025-54428 · Unknown · Kohana Kodicms

Hiro · Published 2025-12-31 · Updated 2025-12-31 · CVE-2025-15393

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kohana KodiCMS versions prior to 13.82.135

Description A security issue exists in Kohana KodiCMS. The Save function within the file cms/modules/kodicms/classes/kodicms/model/file.php of the Layout API Endpoint is affected. Manipulation of the content argument can lead to code injection. This attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations Update Kohana KodiCMS to a version later than 13.82.135.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2025-15393

Affected Products

Kohana Kodicms

References · 7

• 🔥 https://vuldb.com/?submit.718290 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15393 · Security Note
• https://vuldb.com/?ctiid.339162 · Note
• https://twitter.com/CVEnew/status/2006495401189187974 · Twitter Post
• https://t.me/CVEtracker/41100 · Telegram Post
• https://vuldb.com/?id.339162 · Note