PT-2026-1007 · Phpems · Phpems

Byebyedoggy · Published 2026-01-01 · Updated 2026-01-01 · CVE-2025-15405

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPEMS versions up to 11.0

Description A cross-site request forgery condition exists in PHPEMS. The issue is triggered by manipulation of an unknown function and can be exploited remotely.

Recommendations Versions prior to 11.0 should be updated.

Exploit

Fix

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2025-15405

Affected Products

Phpems

References · 10

• 🔥 https://byebydoggy.github.io/post/2025/1231-phpems-csrf-poc · Exploit
• https://osv.dev/vulnerability/CVE-2025-15405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15405 · Security Note
• https://twitter.com/CVEnew/status/2006861509188559268 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2006752967085441294 · Twitter Post
• https://t.me/CVEtracker/41174 · Telegram Post
• https://vuldb.com/?id.339325 · Note
• https://vuldb.com/?ctiid.339325 · Note
• https://vuldb.com/?submit.728314 · Note
• https://t.me/cveNotify/147436 · Telegram Post