Threats Tagged 'cve-2025-7063'

CVE-2025-7063 is a critical vulnerability in the Polska Akademia Dostępności (PAD) CMS that allows unauthenticated remote attackers to upload files of any type due to a client-controlled permission check parameter. This unrestricted file upload can lead to remote code execution (RCE) on affected systems. The vulnerability affects all three PAD CMS templates (www, bip, ww+bip) and the product is end-of-life with no patches forthcoming. The CVSS 4.0 base score is 10.0, indicating a critical severity with network attack vector, no authentication or user interaction required, and high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the risk is significant given the ease of exploitation and potential for full system compromise. European organizations using PAD CMS should urgently consider mitigation strategies including isolating affected systems, disabling file upload functionality, or migrating to alternative CMS platforms. Poland is the most likely affected country due to the product’s origin and usage, but other European countries using PAD CMS may also be at risk. Immediate action is recommended given the lack of vendor support and critical nature of this vulnerability.

CriticalVulnerabilityPolandGermanyFrance+3#cve#cve-2025-7063#cwe-434