CVE-2025-57130
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user, including administrators.
Risk Assessment
The risk involves potential takeover of an administrator account by a low-privilege attacker, which could lead to full compromise of the CMS system and its stored data.
Recommendation
It is recommended to immediately update ZwiiCMS to the latest available version that fixes this vulnerability. If an update is not possible, restrict access to the admin panel to trusted IP addresses only.
Other vulnerabilities in ZwiiCMS
Original NVD description (English source)
An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user, including administrators.