CVE-2025-61505: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should immediately audit their use of e107 CMS and identify any instances running version 2.3.3 or earlier. Since no official patches are currently available, administrators should consider the following mitigations: 1) Restrict access to the install.php script by IP whitelisting or web server configuration to prevent unauthorized access. 2) Disable or remove the install.php script entirely on production systems after installation or upgrade to prevent exploitation. 3) Implement web application firewall (WAF) rules to detect and block suspicious POST requests containing base64-encoded serialized data targeting previous_steps parameter. 4) Monitor web server logs for unusual requests or error patterns indicative of deserialization attempts. 5) If possible, update or patch the CMS to a version that addresses this vulnerability once available. 6) Conduct code reviews to identify and refactor any other unsafe unserialize calls in the application. 7) Employ runtime application self-protection (RASP) or endpoint detection and response (EDR) tools to detect anomalous behaviors resulting from exploitation attempts. These steps will reduce the attack surface and help detect or prevent exploitation until an official patch is released.
Description
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing attackers to craft malicious serialized data. This could lead to remote code execution, arbitrary file operations, or denial of service, depending on available PHP object gadgets in the codebase.