CVE-2025-23952
CVSS 3.1 Score 8.1 of 10 (high)
Details
Published Mar 26, 2025
Updated: Mar 27, 2025
CWE ID 98
Summary
CVE-2025-23952 is a newly disclosed vulnerability affecting the ntm custom-field-list-widget in PHP. This issue results from the software's improper handling of filename control in include/require statements, leading to a Local File Inclusion (LFI) vulnerability. An attacker can exploit this weakness to access and potentially run arbitrary PHP code on the affected system. The vulnerability exists in all versions of custom-field-list-widget from 1.5.1 and older. It is essential for users to update their software to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.