CVE-2025-65271
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Client-side template injection (CSTI) in the Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.
Risk Assessment
A low-privilege user could take over an administrator account and gain full control over the CMS. This leads to a serious security breach and the ability to modify or steal data.
Recommendation
Upgrade Azuriom CMS to version 1.2.7 or later and review plugins and dashboard components for rendering untrusted user input.
Other vulnerabilities in Azuriom CMS
See all- CVE-2026-19975Low
A weakness has been identified in Azuriom CMS up to version 1.2.12. This affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the Money Transfer Handler component. The manipulation causes a time-of-check time-of-use issue. The attack can be initiated remotely but requires high complexity.
- CVE-2026-54415High
Missing authorization in the server management routes in Azuriom CMS before version 1.2.11 allows an authenticated attacker with admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses.
Original NVD description (English source)
Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS