PT-2026-1039 · Empiresoft · Empirecms

Gets · Published 2026-01-02 · Updated 2026-01-07 · CVE-2025-15422

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions EmpireSoft EmpireCMS versions up to 8.0

Description A security issue exists in EmpireSoft EmpireCMS related to the IP Address Handler component. The issue resides in the egetip function within the e/class/connect.php file. This flaw results in a failure of protection mechanisms. The attack can be initiated remotely. The exploit for this issue has been published. The vendor was notified but did not respond.

Recommendations Versions prior to 8.0 should be updated. As a temporary workaround, consider restricting access to the e/class/connect.php file to minimize the risk of exploitation.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2025-15422

Affected Products

Empirecms

References · 12

• 🔥 https://note-hxlab.wetolink.com/share/0x74KEtzecFb#-span--strong-proof-of-concept---strong---span- · Exploit
• 🔥 https://note-hxlab.wetolink.com/share/0x74KEtzecFb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15422 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15422 · Vendor Advisory
• https://t.me/cveNotify/147995 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2006968105214308527 · Twitter Post
• https://vuldb.com/?id.339344 · Note
• https://vuldb.com/?submit.721344 · Note
• https://vuldb.com/?ctiid.339344 · Note
• https://t.me/CVEtracker/41210 · Telegram Post
• https://t.me/cveNotify/147469 · Telegram Post
• https://t.me/cveNotify/147779 · Telegram Post