CVE-2025-10993

MediumCVSS 4.7

Published: 26/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A security flaw was discovered in MuYuCMS up to 2.7 affecting unknown functionality of the /admin.php file in the Template Management component. Manipulation results in code injection, and the attack can be launched remotely.

Risk Assessment

Remote code injection may allow an attacker to execute arbitrary code in the application context, leading to system compromise. Risk is high if the admin panel is network-accessible.

Recommendation

Restrict access to /admin.php to trusted IP addresses and consider updating MuYuCMS. Implement input validation in the template management module.

Other vulnerabilities in MuYuCMS

CVE-2025-10787Medium
A vulnerability was found in MuYuCMS up to 2.7 in an unknown function of /index/index.html within the Add Fiend Link Handler component. Manipulating the Link URL argument results in server-side request forgery (SSRF).

Original NVD description (English source)

A security flaw has been discovered in MuYuCMS up to 2.7. Affected by this issue is some unknown functionality of the file /admin.php of the component Template Management. The manipulation results in code injection. It is possible to launch the attack remotely.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS