TI-2025-04937 Aliases CVE-2025-5497 GHSA-h582-52vg-77xv

slackero phpwcms Feedimport processing.inc.php deserialization

MEDIUM 57CWE-20Published 2025-06-03 · Updated 2025-08-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00699 53rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed phpwcms (slackero): 1.9.46, 1.10.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
slackero	phpwcms	1.9.0; 1.9.1; 1.9.2; 1.9.3; 1.9.4; 1.9.5; 1.9.6; 1.9.7; 1.9.8; 1.9.9; 1.9.10; 1.9.11; 1.9.12; 1.9.13; 1.9.14; 1.9.15; 1.9.16; 1.9.17; 1.9.18; 1.9.19; 1.9.20; 1.9.21; 1.9.22; 1.9.23; 1.9.24; 1.9.25; 1.9.26; 1.9.27; 1.9.28; 1.9.29; 1.9.30; 1.9.31; 1.9.32; 1.9.33; 1.9.34; 1.9.35; 1.9.36; 1.9.37; 1.9.38; 1.9.39; 1.9.40; 1.9.41; 1.9.42; 1.9.43; 1.9.44; 1.9.45; 1.10.0; 1.10.1; 1.10.2; 1.10.3; 1.10.4; 1.10.5; 1.10.6; 1.10.7; 1.10.8	1.9.46, 1.10.9	Patch available	CNA

phpwcms Vendorslackero Affected 1.9.0; 1.9.1; 1.9.2; 1.9.3; 1.9.4; 1.9.5; 1.9.6; 1.9.7; 1.9.8; 1.9.9; 1.9.10; 1.9.11; 1.9.12; 1.9.13; 1.9.14; 1.9.15; 1.9.16; 1.9.17; 1.9.18; 1.9.19; 1.9.20; 1.9.21; 1.9.22; 1.9.23; 1.9.24; 1.9.25; 1.9.26; 1.9.27; 1.9.28; 1.9.29; 1.9.30; 1.9.31; 1.9.32; 1.9.33; 1.9.34; 1.9.35; 1.9.36; 1.9.37; 1.9.38; 1.9.39; 1.9.40; 1.9.41; 1.9.42; 1.9.43; 1.9.44; 1.9.45; 1.10.0; 1.10.1; 1.10.2; 1.10.3; 1.10.4; 1.10.5; 1.10.6; 1.10.7; 1.10.8 Fixed in 1.9.46, 1.10.9 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:phpwcms:phpwcms::::::::	before 1.10.8	Vulnerable	slackero

cpe:2.3:a:phpwcms:phpwcms:*:*:*:*:*:*:*:* Versions before 1.10.8 Vulnerable ·slackero

Remediation

Fix · CNA phpwcms (slackero) Fixed in 1.9.46, 1.10.9

Timeline

2026-10-02 Threatist record created from CVE-2025-5497
2026-10-03 Alias added: GHSA-h582-52vg-77xv
2026-10-24 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://github.com/3em0/cve_repo/blob/main/phpwcms/phar%20vulnerability%20in%20phpwcms.md

Patch 2

TI-2021-14759 An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via… CVSS 3.1CRITICAL 9.8
TI-2021-14761 File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code… CVSS 3.1HIGH 8.8
TI-2025-04939 slackero phpwcms image_resized.php getimagesize deserialization CVSS 4.0MEDIUM 6.9
TI-2021-14760 Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete… CVSS 3.1MEDIUM 5.4
TI-2021-22399 Phpwcms 1.9.30 - Arbitrary File Upload CVSS 4.0MEDIUM 5.3
TI-2025-04938 slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization CVSS 4.0MEDIUM 5.1

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences