CVE-2025-8116
Last modified
CVE-2025-8116 is a medium-severity vulnerability rated 5.1/10 on the CVSS scale. PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in victim's browser, when opened. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in victim's browser, when opened. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Widzialni | Pad Cms | <= 1.2.1 |
References
- https://cert.pl/posts/2025/09/CVE-2025-7063Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-8116?
How severe is CVE-2025-8116?
How do I fix CVE-2025-8116?
Are you affected by CVE-2025-8116?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST