Account Takeover via Reset Password Functionality in PAD CMS
Priority LOW 37CWE-909Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00271 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Polska Akademia Dostępności | PAD CMS | up to 1.2.1 | — | No fix listed | CNA |
- PAD CMS VendorPolska Akademia Dostępności Affected up to 1.2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:* | up to 1.2.1 | Vulnerable | Polska Akademia Dostępności |
- cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:* Versions up to 1.2.1 Vulnerable ·Polska Akademia Dostępności
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8117
- 2026-10-03 Alias added: GHSA-fx82-rmfc-9cqg
References
More Polska Akademia Dostępności Pad Cms vulnerabilities
- TI-2025-07429 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
- TI-2025-07428 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
- TI-2025-07427 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-06427 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-06425 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
- TI-2025-07425 Bruteforce Protection Bypass in PAD CMS CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-8117 · CVE Program
- CVE-2025-8117 · NVD
- FIRST EPSS
- GHSA-fx82-rmfc-9cqg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences