CVE-2025-15393

MediumCVSS 6.3

Published: 31/12/2025(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

37th percentile - higher than 37% of all known CVEs

Summary

A vulnerability was detected in Kohana KodiCMS up to version 13.82.135. The Save function in the file cms/modules/kodicms/classes/kodicms/model/file.php of the Layout API Endpoint component allows code injection via manipulation of the content argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Risk Assessment

A remote attacker can inject malicious code, potentially leading to application takeover or data compromise.

Recommendation

Update KodiCMS to a patched version as soon as possible and restrict access to the API.

Other vulnerabilities in KodiCMS

CVE-2025-15392Medium
A vulnerability has been identified in Kohana KodiCMS up to 13.82.135, affecting the like function in cms/modules/pages/classes/kodicms/model/page.php of the Search API Endpoint component. Manipulating the keyword argument can lead to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

Original NVD description (English source)

A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/model/file.php of the component Layout API Endpoint. The manipulation of the argument content leads to code injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS