PatchTheCVEpad cms vulnerabilities and fixes
Recent CVEs affecting pad cms, with upgrade or downgrade steps. 9 tracked.
Also searched as: padcms.
pad cms has 9 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 9. Most recent: 2025-09-30. Highest priority: CVE-2025-7065 (score 52/100).
- CVE-2025-8122 HIGH 8.8 UPGRADE Improper neutralization of input provided by an authorized user in article positioning functionality allows fo
- CVE-2025-8121 HIGH 8.8 UPGRADE Improper neutralization of input provided by an authorized user in article positioning functionality allows fo
- CVE-2025-8120 CRITICAL 9.8 UPGRADE Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenti
- CVE-2025-8119 MEDIUM 4.3 UPGRADE PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality
- CVE-2025-8118 MEDIUM 6.5 UPGRADE PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_ti
- CVE-2025-8117 HIGH 7.5 UPGRADE PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any u
- CVE-2025-8116 MEDIUM 6.1 UPGRADE PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality
- CVE-2025-7065 CRITICAL 9.8 UPGRADE Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenti
- CVE-2025-7063 CRITICAL 9.8 UPGRADE Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthentic
FAQ
How do I fix pad cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pad cms being exploited right now?
None of the tracked pad cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pad cms CVE should I patch first?
CVE-2025-7065 currently ranks highest (52/100): Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenti.