NVD CVE-2025-5425

nvd.nist.gov • April 30, 2026

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early this disclosure but did not respond in any way.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in JuzaWeb CMS Exposes Users to Exploitation A critical vulnerability (CVE-2025-5425) has been identified in JuzaWeb CMS version 3.4.2, allowing authenticated remote code execution through broken access controls on the Theme Editor page. This flaw permits any authenticated user, regardless of privilege level, to access sensitive administrative functions and inject malicious PHP code. The vulnerability is actively exploited in the wild, with public proof-of-concept exploits available. Organizations using JuzaWeb CMS 3.4.2 or earlier are at immediate risk and should take urgent action to mitigate this threat. The vulnerability is classified as moderate on the CVSS v4.0 scale, with a base score of 5.3, impacting confidentiality, integrity, and availability. Indicators of compromise include unauthorized access to the Theme Editor and modifications to theme files. The vendor has not responded to disclosures regarding this vulnerability. 2 sources 72

Extracted Entities

CVEs (1)

CVE-2025-5425