Approved changes feed: RSS · Atom
cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Widzialni (cdd07d06-07a4-5eca-ae9f-6a03923164f1) |
|---|---|
| Product | Pad Cms (886dd296-4a1e-58b5-9751-7f78fb321cee) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-8122 |
vulnerable | 2026-06-08 07:45:19.651921 |
Blind SQL Injection in PAD CMS
Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Published: 2025-09-30T10:05:21.046Z
Updated: 2025-09-30T19:16:36.187Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8121 |
vulnerable | 2026-06-08 07:45:19.651600 |
Blind SQL Injection in PAD CMS
Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Published: 2025-09-30T10:05:13.295Z
Updated: 2025-09-30T19:15:53.681Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8120 |
vulnerable | 2026-06-08 07:45:19.651156 |
Remote Code Execution via Unrestricted File Upload in PAD CMS
Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Published: 2025-09-30T10:05:03.496Z
Updated: 2025-09-30T19:15:27.470Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8119 |
vulnerable | 2026-06-08 07:45:19.650812 |
Cross-Site Request Forgery in PAD CMS
PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Published: 2025-09-30T10:04:54.900Z
Updated: 2025-09-30T19:14:50.548Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8118 |
vulnerable | 2026-06-08 07:45:19.650342 |
Bruteforce Protection Bypass in PAD CMS
PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Published: 2025-09-30T10:04:46.284Z
Updated: 2025-09-30T19:14:22.705Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8117 |
vulnerable | 2026-06-08 07:45:19.649959 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8116 |
vulnerable | 2026-06-08 07:45:19.649340 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-7065 |
vulnerable | 2026-06-08 07:43:17.951394 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-7063 |
vulnerable | 2026-06-08 07:43:17.950957 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.