CVE-2025-5498

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-5498

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5498.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-5498

Published

2025-06-03T13:31:05.263Z

Modified

2026-07-15T01:49:10.654988047Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization

Details

A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function filegetcontents/isfile of the file include/inclib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpage_custom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5498.json",
    "cwe_ids": [
        "CWE-20",
        "CWE-502"
    ],
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.9.0"
                },
                {
                    "last_affected": "1.9.0"
                },
                {
                    "introduced": "1.9.1"
                },
                {
                    "last_affected": "1.9.1"
                },
                {
                    "introduced": "1.9.4"
                },
                {
                    "last_affected": "1.9.4"
                },
                {
                    "introduced": "1.9.9"
                },
                {
                    "last_affected": "1.9.9"
                },
                {
                    "introduced": "1.9.10"
                },
                {
                    "last_affected": "1.9.10"
                },
                {
                    "introduced": "1.9.14"
                },
                {
                    "last_affected": "1.9.14"
                },
                {
                    "introduced": "1.9.31"
                },
                {
                    "last_affected": "1.9.31"
                },
                {
                    "introduced": "1.10.0"
                },
                {
                    "last_affected": "1.10.0"
                },
                {
                    "introduced": "1.10.1"
                },
                {
                    "last_affected": "1.10.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/slackero/phpwcms

Affected ranges

Type

GIT

Repo

https://github.com/slackero/phpwcms

Events

Introduced

Fixed

a8b49f44626c4ba1d4a1582f28ed9f2ed7043478

Introduced

4ec6be9b2b92b3247995fb6fa5179ba12ff3bfdc

Fixed

d6f8c5c7df18158f6c6d762cc3883b53783c9028

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.46"
        },
        {
            "introduced": "1.10.2"
        },
        {
            "fixed": "1.10.9"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:phpwcms:phpwcms:*:*:*:*:*:*:*:*"
}

Affected versions

1.*

1.10.2

1.10.3

1.10.4

1.10.5

1.10.6

1.10.7

1.10.8

1.9.11

1.9.12

1.9.13

1.9.15

1.9.16

1.9.17

1.9.18

1.9.19

1.9.2

1.9.20

1.9.21

1.9.22

1.9.23

1.9.24

1.9.25

1.9.26

1.9.27

1.9.28

1.9.29

1.9.3

1.9.30

1.9.32

1.9.33

1.9.34

1.9.35

1.9.36

1.9.37

1.9.38

1.9.39

1.9.40

1.9.41

1.9.42

1.9.43

1.9.44

1.9.45

1.9.5

1.9.6

1.9.7

1.9.8

phpwcms-1.*

phpwcms-1.6.529

phpwcms-1.6.531

phpwcms-1.7.0

phpwcms-1.7.1

phpwcms-1.7.2

phpwcms-1.7.3

phpwcms-1.7.4

phpwcms-1.7.5

phpwcms-1.7.6

phpwcms-1.7.7

phpwcms-1.7.9

phpwcms-1.8.0

phpwcms-1.8.0-RC1

phpwcms-1.8.0-RC2

phpwcms-1.8.1

phpwcms-1.8.2

phpwcms-1.8.3

phpwcms-1.8.4

phpwcms-1.9.0-beta.4

phpwcms-1.9.0-beta.5

phpwcms-1.9.0-beta.6

phpwcms-1.9.0-beta.7

phpwcms-1.9.0-rc.1

phpwcms-1.9.0-rc.2

phpwcms-1.9.2

phpwcms-1.9.3

phpwcms-1.9.5

phpwcms-1.9.6

phpwmcs-1.*

phpwmcs-1.9.0-beta.8

v1.*

v1.10.2

v1.10.3

v1.10.4

v1.10.5

v1.10.6

v1.10.7

v1.10.8

v1.9.11

v1.9.12

v1.9.13

v1.9.15

v1.9.16

v1.9.17

v1.9.18

v1.9.19

v1.9.20

v1.9.21

v1.9.22

v1.9.23

v1.9.24

v1.9.25

v1.9.26

v1.9.27

v1.9.28

v1.9.29

v1.9.30

v1.9.32

v1.9.33

v1.9.34

v1.9.35

v1.9.36

v1.9.37

v1.9.39

v1.9.40

v1.9.41

v1.9.42

v1.9.43

v1.9.44

v1.9.45

v1.9.7

v1.9.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5498.json"