CVE-2025-15422

MediumCVSS 5.3

Published: 02/01/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.27%

69th percentile - higher than 69% of all known CVEs

Summary

A flaw was found in EmpireSoft EmpireCMS up to 8.0 in the egetip function of the file e/class/connect.php in the IP Address Handler component. Manipulation causes protection mechanism failure. The attack can be initiated remotely, and the exploit has been published.

Risk Assessment

The organization may be exposed to remote bypass of security controls, potentially leading to unauthorized access or system integrity compromise.

Recommendation

Apply available patches or update EmpireCMS to the latest version immediately, and monitor the system for suspicious activity.

Other vulnerabilities in EmpireCMS

CVE-2025-15423Medium
A vulnerability was found in EmpireSoft EmpireCMS up to 8.0 in the CheckSaveTranFiletype function of the file e/class/connect.php, allowing unrestricted upload. The attack can be launched remotely, and the exploit has been disclosed publicly.

Original NVD description (English source)

A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. This manipulation causes protection mechanism failure. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS