SecuriTricks - CVE-2025-14731

Description

A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser.php of the component Frontend/Template Management Module. This manipulation causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Product(s) Impacted

Product	Versions

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-791

Incomplete Filtering of Special Elements

The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

References

https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN

https://note-hxlab.wetolink.com/share/U6cnRoRfn09r

https://vuldb.com/?ctiid.336488

https://vuldb.com/?id.336488

https://vuldb.com/?submit.707106

https://vuldb.com/?submit.707107

https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN

https://note-hxlab.wetolink.com/share/U6cnRoRfn09r

CVSS Score

5.3 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: LOW
Attack Requirements: NONE
Privileges Required: LOW
User Interaction: NONE
Scope:
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: LOW
Exploit Maturity: PROOF_OF_CONCEPT

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

View Vector String

Timeline

Published: Dec. 16, 2025, 12:16 a.m.
Last Modified: Dec. 16, 2025, 4:15 p.m.

Status : Undergoing Analysis

CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.

More info

Source

cna@vuldb.com

CVE-2025-14731