CVE-2025-5429
Last modified
CVE-2025-5429 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of the component Plugins Page. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of the component Plugins Page. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Juzaweb | Cms | >= 3.4, <= 3.4.2 |
References
- https://vuldb.com/?ctiid.310762Permissions Required, VDB Entry
- https://vuldb.com/?id.310762Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.584057Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-5429?
How severe is CVE-2025-5429?
How do I fix CVE-2025-5429?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54283Illustrator versions 29.7, 28.7.9 and earlier are affected b…7.8
- CVE-2025-54284Illustrator versions 29.7, 28.7.9 and earlier are affected b…7.8
- CVE-2025-54286Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD…8.8
- CVE-2025-54287Template Injection in instance snapshot creation component i…6.5
- CVE-2025-54288Information Spoofing in devLXD Server in Canonical LXD versi…6.8
- CVE-2025-54289Privilege Escalation in operations API in Canonical LXD <6.5…8.1
- CVE-2025-54290Information disclosure in image export API in Canonical LXD …5.3
- CVE-2025-54291Information disclosure in images API in Canonical LXD before…5.3
- CVE-2025-54292Path traversal in Canonical LXD LXD-UI versions before 6.5 a…4.6
- CVE-2025-54293Path Traversal in the log file retrieval function in Canonic…6.5
- CVE-2025-54294A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joo…9.3
- CVE-2025-54295A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.…5.1
Are you affected by CVE-2025-5429?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST