Reflected XSS in PAD CMS
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in victim's browser, when opened. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Polska Akademia Dostępności | PAD CMS | up to 1.2.1 | — | No fix listed | CNA |
- PAD CMS VendorPolska Akademia Dostępności Affected up to 1.2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:* | up to 1.2.1 | Vulnerable | Polska Akademia Dostępności |
- cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:* Versions up to 1.2.1 Vulnerable ·Polska Akademia Dostępności
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8116
- 2026-10-03 Alias added: GHSA-8f79-h8fw-j73f
References
More Polska Akademia Dostępności Pad Cms vulnerabilities
- TI-2025-07429 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
- TI-2025-07428 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
- TI-2025-07427 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-06427 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-06425 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-07424 Account Takeover via Reset Password Functionality in PAD CMS CVSS 4.0HIGH 8.7
Sources
- CVE-2025-8116 · CVE Program
- CVE-2025-8116 · NVD
- FIRST EPSS
- GHSA-8f79-h8fw-j73f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences