Critical severity9.8NVD Advisory· Published Sep 30, 2025· Updated Jun 17, 2026
CVE-2025-8120
CVE-2025-8120
Description
Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Polska Akademia Dostępności/PAD CMSv5Range: 0
Patches
Vulnerability mechanics
References
1- cert.pl/posts/2025/09/CVE-2025-7063nvdThird Party Advisory
News mentions
0No linked articles in our index yet.