CVE-2025-25967

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.

• CWE-352
• CWE-352

• https://github.com/padayali-JD/CVE-2025-25967Third Party Advisory

Published

Mar 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25953Serosoft Solutions Pvt Ltd Academia Student Information Syst…6.5
• CVE-2025-25957Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 an…6.1
• CVE-2025-25958Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 all…5.4
• CVE-2025-2596Session logout could be overwritten in Checkmk GmbH's Checkm…5.3
• CVE-2025-25960Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allow…6.1
• CVE-2025-25962An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.…9.8
• CVE-2025-25968DDSN Interactive cm3 Acora CMS version 10.1.1 contains an im…6
• CVE-2025-2597Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5…6.1
• CVE-2025-25973A stored Cross Site Scripting vulnerability in the "related …6.5
• CVE-2025-25975An issue in parse-git-config v.3.0.0 allows an attacker to o…7.5
• CVE-2025-25977An issue in canvg v.4.0.2 allows an attacker to execute arbi…9.8
• CVE-2025-2598When the AWS Cloud Development Kit (AWS CDK) Command Line In…5.7