CVE-2025-3563

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-3563

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3563.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-3563

Published

2025-04-14T11:00:12.175Z

Modified

2026-07-15T01:49:05.936227683Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

WuzhiCMS Setting index.php set code injection

Details

A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=index&_su=wuzhicms&v=set&submit=1 of the component Setting Handler. The manipulation of the argument Setting leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.1"
                },
                {
                    "last_affected": "4.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3563.json"
}

References

Affected packages

Git / github.com/wuzhicms/wuzhicms

Affected ranges

Type

GIT

Repo

https://github.com/wuzhicms/wuzhicms

Events

Introduced

0a9144f8da632bbf69d53e4126bc2b6c0b08ee0d

Last affected

0a9144f8da632bbf69d53e4126bc2b6c0b08ee0d

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.0"
        }
    ],
    "cpe": "cpe:2.3:a:wuzhicms:wuzhicms:4.1.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

4.*

4.1.0

v4.*

v4.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3563.json"