CVE-2025-15187

LowCVSS 3.8

Published: 29/12/2025(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

43th percentile - higher than 43% of all known CVEs

Summary

A vulnerability was found in GreenCMS up to version 2.3 in the file /DataController.class.php of the File Handler component. Manipulation of the sqlFiles/zipFiles arguments leads to path traversal. The attack can be initiated remotely and the exploit has been made public.

Risk Assessment

The vulnerability allows remote access to files outside the application directory, potentially leading to disclosure of sensitive data or file modification. Since the product is no longer supported, the risk is higher due to lack of patches.

Recommendation

It is recommended to immediately stop using GreenCMS and migrate to a supported system. If necessary, apply available workarounds or network protections.

Other vulnerabilities in GreenCMS

CVE-2025-14244Low
A cross-site scripting vulnerability was found in GreenCMS 2.3.0603 within the Menu Management Page functionality, in the file /Admin/Controller/CustomController.class.php. Manipulation of the Link argument allows script injection, and the attack can be initiated remotely. The exploit has been published and may be used.

Original NVD description (English source)

A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a manipulation of the argument sqlFiles/zipFiles results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS