CVE-2025-15423

MediumCVSS 6.3

Published: 02/01/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

28th percentile - higher than 28% of all known CVEs

Summary

A vulnerability was found in EmpireSoft EmpireCMS up to 8.0 in the CheckSaveTranFiletype function of the file e/class/connect.php, allowing unrestricted upload. The attack can be launched remotely, and the exploit has been disclosed publicly.

Risk Assessment

Unrestricted file upload may allow an attacker to upload malicious files, potentially leading to remote code execution or server takeover.

Recommendation

Upgrade EmpireCMS to the latest version immediately and implement additional file upload validation mechanisms.

Other vulnerabilities in EmpireCMS

CVE-2025-15422Medium
A flaw was found in EmpireSoft EmpireCMS up to 8.0 in the egetip function of the file e/class/connect.php in the IP Address Handler component. Manipulation causes protection mechanism failure. The attack can be initiated remotely, and the exploit has been published.

Original NVD description (English source)

A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS