CVE-2025-3799
CVSS 3.1 Score 7.3 of 10 (high)
Details
Published Apr 19, 2025
Updated: Apr 21, 2025
CWE ID 89
CWE ID 74
Summary
CVE-2025-3799 is a critical vulnerability identified in WCMS 11. This issue lies within the unknown function of the file app/controllers/AnonymousController.php. The vulnerability is triggered by manipulating the argument email/username, enabling attackers to conduct sql injection attacks. These assaults can be launched remotely, increasing the threat level. The exploit for this vulnerability has been made public, putting numerous systems at risk. Additionally, other parameters in the application might be susceptible to similar attacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- W-cms
Affected Vendors
- W-cms