CVE-2025-14731
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In CTCMS Content Management System up to version 2.1.2, there is a vulnerability in the template management module (CT_Parser.php). Improper neutralization of special elements in the template engine allows remote attacks.
Risk Assessment
The risk includes remote code execution or content manipulation, potentially leading to application takeover.
Recommendation
Upgrade CTCMS to the latest version or apply available security patches.
Other vulnerabilities in CTCMS
See all- CVE-2025-14730Medium
A code injection vulnerability has been discovered in CTCMS Content Management System up to version 2.1.2, affecting an unknown function in the /ctcms/libs/Ct_Config.php library within the Backend System Configuration Module. Manipulating the Cj_Add/Cj_Edit arguments allows remote code execution. The exploit is publicly available.
- CVE-2025-14729Medium
A code injection vulnerability has been identified in CTCMS Content Management System up to version 2.1.2, affecting the Save function in the /ctcms/libs/Ct_App.php file within the Backend App Configuration Module. Manipulating the CT_App_Paytype argument allows remote code execution. The exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser.php of the component Frontend/Template Management Module. This manipulation causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS