CVE-2025-8119 (GCVE-0-2025-8119)

Vulnerability from cvelistv5 – Published: 2025-09-30 10:04 – Updated: 2025-09-30 19:14 Unsupported When Assigned
VLAI
Title
Cross-Site Request Forgery in PAD CMS
Summary
PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
Polska Akademia Dostępności PAD CMS Affected: 0 , ≤ 1.2.1 (semver)
Create a notification for this product.
Date Public
2025-09-30 09:55
Credits
CERT.PL
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T19:14:39.077542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T19:14:50.548Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "PAD CMS",
          "vendor": "Polska Akademia Dost\u0119pno\u015bci",
          "versions": [
            {
              "lessThanOrEqual": "1.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CERT.PL"
        }
      ],
      "datePublic": "2025-09-30T09:55:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PAD CMS is vulnerable to Cross-Site Request Forgery in reset password\u0027s functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user\u0027s password to defined by the attacker value.\u0026nbsp;This issue affects all 3 templates: www, bip and www+bip.\u003cbr\u003e\u003cbr\u003eThis product is End-Of-Life and producent will not publish patches for this vulnerability. \u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "PAD CMS is vulnerable to Cross-Site Request Forgery in reset password\u0027s functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user\u0027s password to defined by the attacker value.\u00a0This issue affects all 3 templates: www, bip and www+bip.\n\nThis product is End-Of-Life and producent will not publish patches for this vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-30T10:04:54.900Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "url": "https://cert.pl/posts/2025/09/CVE-2025-7063"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Cross-Site Request Forgery in PAD CMS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2025-8119",
    "datePublished": "2025-09-30T10:04:54.900Z",
    "dateReserved": "2025-07-24T14:23:32.250Z",
    "dateUpdated": "2025-09-30T19:14:50.548Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-8119",
      "date": "2026-07-09",
      "epss": "0.00119",
      "percentile": "0.02135"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-8119\",\"sourceIdentifier\":\"cvd@cert.pl\",\"published\":\"2025-09-30T11:37:44.167\",\"lastModified\":\"2026-06-17T10:06:20.390\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[{\"sourceIdentifier\":\"cvd@cert.pl\",\"tags\":[\"unsupported-when-assigned\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PAD CMS is vulnerable to Cross-Site Request Forgery in reset password\u0027s functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user\u0027s password to defined by the attacker value.\u00a0This issue affects all 3 templates: www, bip and www+bip.\\n\\nThis product is End-Of-Life and producent will not publish patches for this vulnerability.\"},{\"lang\":\"es\",\"value\":\"PAD CMS es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en la funcionalidad de restablecimiento de contrase\u00f1a. Un atacante malicioso puede crear un sitio web especial que, al ser visitado por la v\u00edctima, enviar\u00e1 autom\u00e1ticamente una petici\u00f3n POST cambiando la contrase\u00f1a del usuario actualmente autenticado al valor definido por el atacante. Este problema afecta a las 3 plantillas: www, bip y www+bip.\\n\\nEste producto est\u00e1 al final de su vida \u00fatil y el productor no publicar\u00e1 parches para esta vulnerabilidad.\"}],\"affected\":[{\"source\":\"cvd@cert.pl\",\"affectedData\":[{\"vendor\":\"Polska Akademia Dost\u0119pno\u015bci\",\"product\":\"PAD CMS\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"1.2.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cvd@cert.pl\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-09-30T19:14:39.077542Z\",\"id\":\"CVE-2025-8119\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cvd@cert.pl\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2.1\",\"matchCriteriaId\":\"F470DB7E-6AE8-4B22-9D20-38CC7D199023\"}]}]}],\"references\":[{\"url\":\"https://cert.pl/posts/2025/09/CVE-2025-7063\",\"source\":\"cvd@cert.pl\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-10-01T10:11:57+00:00",
      "cve": "CVE-2025-8119",
      "id": "CVE-2025-8119",
      "initial_release_date": "2025-09-30T09:55:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cross-Site Request Forgery in PAD CMS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8119.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-8119\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-30T19:14:39.077542Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-30T19:14:44.368Z\"}}], \"cna\": {\"tags\": [\"unsupported-when-assigned\"], \"title\": \"Cross-Site Request Forgery in PAD CMS\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"CERT.PL\"}], \"impacts\": [{\"capecId\": \"CAPEC-62\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-62 Cross Site Request Forgery\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Polska Akademia Dost\\u0119pno\\u015bci\", \"product\": \"PAD CMS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.2.1\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2025-09-30T09:55:00.000Z\", \"references\": [{\"url\": \"https://cert.pl/posts/2025/09/CVE-2025-7063\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"PAD CMS is vulnerable to Cross-Site Request Forgery in reset password\u0027s functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user\u0027s password to defined by the attacker value.\\u00a0This issue affects all 3 templates: www, bip and www+bip.\\n\\nThis product is End-Of-Life and producent will not publish patches for this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"PAD CMS is vulnerable to Cross-Site Request Forgery in reset password\u0027s functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user\u0027s password to defined by the attacker value.\u0026nbsp;This issue affects all 3 templates: www, bip and www+bip.\u003cbr\u003e\u003cbr\u003eThis product is End-Of-Life and producent will not publish patches for this vulnerability. \u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-352\", \"description\": \"CWE-352 Cross-Site Request Forgery (CSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6\", \"shortName\": \"CERT-PL\", \"dateUpdated\": \"2025-09-30T10:04:54.900Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-8119\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-30T19:14:50.548Z\", \"dateReserved\": \"2025-07-24T14:23:32.250Z\", \"assignerOrgId\": \"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6\", \"datePublished\": \"2025-09-30T10:04:54.900Z\", \"assignerShortName\": \"CERT-PL\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.