CVE-2025-14729
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A code injection vulnerability has been identified in CTCMS Content Management System up to version 2.1.2, affecting the Save function in the /ctcms/libs/Ct_App.php file within the Backend App Configuration Module. Manipulating the CT_App_Paytype argument allows remote code execution. The exploit is publicly available.
Risk Assessment
A remote attacker can exploit this vulnerability to execute arbitrary code in the context of the application, potentially leading to data integrity compromise and system takeover.
Recommendation
Upgrade CTCMS to a patched version as soon as possible and restrict access to the admin panel. Also monitor system logs for any suspicious activity.
Other vulnerabilities in CTCMS
See all- CVE-2025-14731Medium
In CTCMS Content Management System up to version 2.1.2, there is a vulnerability in the template management module (CT_Parser.php). Improper neutralization of special elements in the template engine allows remote attacks.
- CVE-2025-14730Medium
A code injection vulnerability has been discovered in CTCMS Content Management System up to version 2.1.2, affecting an unknown function in the /ctcms/libs/Ct_Config.php library within the Backend System Configuration Module. Manipulating the Cj_Add/Cj_Edit arguments allows remote code execution. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS