TI-2025-07426 Aliases CVE-2025-8119 GHSA-28mw-j8x6-mf8x

Cross-Site Request Forgery in PAD CMS

LOW 22CWE-352Published 2025-09-30 · Updated 2025-09-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00128 2nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Polska Akademia Dostępności	PAD CMS	up to 1.2.1	—	No fix listed	CNA

PAD CMS VendorPolska Akademia Dostępności Affected up to 1.2.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:widzialni:pad_cms::::::::	up to 1.2.1	Vulnerable	Polska Akademia Dostępności

cpe:2.3:a:widzialni:pad_cms:*:*:*:*:*:*:*:* Versions up to 1.2.1 Vulnerable ·Polska Akademia Dostępności

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-8119
2026-10-03 Alias added: GHSA-28mw-j8x6-mf8x

References

Advisory 1

https://cert.pl/posts/2025/09/CVE-2025-7063

TI-2025-07429 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
TI-2025-07428 Blind SQL Injection in PAD CMS CVSS 4.0HIGH 8.7
TI-2025-07427 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
TI-2025-06427 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
TI-2025-06425 Remote Code Execution via Unrestricted File Upload in PAD CMS CVSS 4.0CRITICAL 10.0
TI-2025-07424 Account Takeover via Reset Password Functionality in PAD CMS CVSS 4.0HIGH 8.7

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences