CVE-2025-14730
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A code injection vulnerability has been discovered in CTCMS Content Management System up to version 2.1.2, affecting an unknown function in the /ctcms/libs/Ct_Config.php library within the Backend System Configuration Module. Manipulating the Cj_Add/Cj_Edit arguments allows remote code execution. The exploit is publicly available.
Risk Assessment
An attacker can remotely inject and execute malicious code, potentially leading to full system compromise, data theft, or disruption of the application.
Recommendation
Immediately upgrade CTCMS to the latest available version if one exists, and restrict access to the admin panel. Monitor the system for suspicious activities.
Other vulnerabilities in CTCMS
See all- CVE-2025-14731Medium
In CTCMS Content Management System up to version 2.1.2, there is a vulnerability in the template management module (CT_Parser.php). Improper neutralization of special elements in the template engine allows remote attacks.
- CVE-2025-14729Medium
A code injection vulnerability has been identified in CTCMS Content Management System up to version 2.1.2, affecting the Save function in the /ctcms/libs/Ct_App.php file within the Backend App Configuration Module. Manipulating the CT_App_Paytype argument allows remote code execution. The exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_Config.php of the component Backend System Configuration Module. The manipulation of the argument Cj_Add/Cj_Edit results in code injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS