CVE-2025-5498

🗓️ 03 Jun 2025 13:31:05Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

Critical vulnerability in slackero phpwcms affects remote deserialization. Upgrade to fix issue.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-5498	3 Jun 202514:58	–	circl
CNNVD	phpwcms 代码问题漏洞	3 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-5498 slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization	3 Jun 202513:31	–	cvelist
EUVD	EUVD-2025-16732	3 Oct 202520:07	–	euvd
NVD	CVE-2025-5498	3 Jun 202514:15	–	nvd
OSV	CVE-2025-5498 slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization	3 Jun 202513:31	–	osv
Positive Technologies	PT-2025-23613	3 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-5498	5 Jun 202514:14	–	redhatcve
Vulnrichment	CVE-2025-5498 slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization	3 Jun 202513:31	–	vulnrichment

NVD

Vulners

Node

phpwcms phpwcmsRange<1.9.46

phpwcms phpwcmsRange1.10.2–1.10.9

[
  {
    "vendor": "slackero",
    "product": "phpwcms",
    "versions": [
      {
        "version": "1.9.0",
        "status": "affected"
      },
      {
        "version": "1.9.1",
        "status": "affected"
      },
      {
        "version": "1.9.2",
        "status": "affected"
      },
      {
        "version": "1.9.3",
        "status": "affected"
      },
      {
        "version": "1.9.4",
        "status": "affected"
      },
      {
        "version": "1.9.5",
        "status": "affected"
      },
      {
        "version": "1.9.6",
        "status": "affected"
      },
      {
        "version": "1.9.7",
        "status": "affected"
      },
      {
        "version": "1.9.8",
        "status": "affected"
      },
      {
        "version": "1.9.9",
        "status": "affected"
      },
      {
        "version": "1.9.10",
        "status": "affected"
      },
      {
        "version": "1.9.11",
        "status": "affected"
      },
      {
        "version": "1.9.12",
        "status": "affected"
      },
      {
        "version": "1.9.13",
        "status": "affected"
      },
      {
        "version": "1.9.14",
        "status": "affected"
      },
      {
        "version": "1.9.15",
        "status": "affected"
      },
      {
        "version": "1.9.16",
        "status": "affected"
      },
      {
        "version": "1.9.17",
        "status": "affected"
      },
      {
        "version": "1.9.18",
        "status": "affected"
      },
      {
        "version": "1.9.19",
        "status": "affected"
      },
      {
        "version": "1.9.20",
        "status": "affected"
      },
      {
        "version": "1.9.21",
        "status": "affected"
      },
      {
        "version": "1.9.22",
        "status": "affected"
      },
      {
        "version": "1.9.23",
        "status": "affected"
      },
      {
        "version": "1.9.24",
        "status": "affected"
      },
      {
        "version": "1.9.25",
        "status": "affected"
      },
      {
        "version": "1.9.26",
        "status": "affected"
      },
      {
        "version": "1.9.27",
        "status": "affected"
      },
      {
        "version": "1.9.28",
        "status": "affected"
      },
      {
        "version": "1.9.29",
        "status": "affected"
      },
      {
        "version": "1.9.30",
        "status": "affected"
      },
      {
        "version": "1.9.31",
        "status": "affected"
      },
      {
        "version": "1.9.32",
        "status": "affected"
      },
      {
        "version": "1.9.33",
        "status": "affected"
      },
      {
        "version": "1.9.34",
        "status": "affected"
      },
      {
        "version": "1.9.35",
        "status": "affected"
      },
      {
        "version": "1.9.36",
        "status": "affected"
      },
      {
        "version": "1.9.37",
        "status": "affected"
      },
      {
        "version": "1.9.38",
        "status": "affected"
      },
      {
        "version": "1.9.39",
        "status": "affected"
      },
      {
        "version": "1.9.40",
        "status": "affected"
      },
      {
        "version": "1.9.41",
        "status": "affected"
      },
      {
        "version": "1.9.42",
        "status": "affected"
      },
      {
        "version": "1.9.43",
        "status": "affected"
      },
      {
        "version": "1.9.44",
        "status": "affected"
      },
      {
        "version": "1.9.45",
        "status": "affected"
      },
      {
        "version": "1.10.0",
        "status": "affected"
      },
      {
        "version": "1.10.1",
        "status": "affected"
      },
      {
        "version": "1.10.2",
        "status": "affected"
      },
      {
        "version": "1.10.3",
        "status": "affected"
      },
      {
        "version": "1.10.4",
        "status": "affected"
      },
      {
        "version": "1.10.5",
        "status": "affected"
      },
      {
        "version": "1.10.6",
        "status": "affected"
      },
      {
        "version": "1.10.7",
        "status": "affected"
      },
      {
        "version": "1.10.8",
        "status": "affected"
      }
    ],
    "modules": [
      "Custom Source Tab"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23file_get_contents.md
github	www.github.com/slackero/phpwcms/releases/tag/v1.10.9
vuldb	www.vuldb.com/
github	www.github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23is_file.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
cpage_custom	query param	include/inc_lib/content/cnt21.readform.inc.php	Deserialization via manipulated cpage_custom parameter in file_get_contents/is_file usage in Custom Source Tab; remote code execution risk.	CWE-502, CWE-20

17 Jun 2026 09:48Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.5 - 7.2

CVSS 45.1

CVSS 26.5

CVSS 35.5

EPSS0.00417

SSVC