CVE-2025-25772
CVSS 3.1 Score 5.1 of 10 (medium)
Details
Published Feb 21, 2025
CWE ID 352
Summary
CVE-2025-25772 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Jspxcms versions 9.0 to 9.5. Attackers can exploit this flaw in the /back/UserController.java component to add Administrator accounts arbitrarily through crafted requests. This vulnerability poses a significant risk, as attackers can gain unauthorized access to administrative functions and potentially compromise the affected system. Users are advised to update their Jspxcms installations to a patched version as soon as possible to mitigate this threat.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.