CVE-2025-14731CWE-1336CWE-791

CVE-2025-14731

Medium · published December 16, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser.php of the component Frontend/Template Management Module. This manipulation causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00449 · 38.1th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-791 · Incomplete Filtering of Special Elements
Published
2025-12-16T05:16Z
Affected products (1)
ProductVersionsFixed in
ctcms_project/ctcms≤ 2.1.2—
References (8)
https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN · [email protected]https://note-hxlab.wetolink.com/share/U6cnRoRfn09r · [email protected]https://vuldb.com/?ctiid.336488 · [email protected]https://vuldb.com/?id.336488 · [email protected]https://vuldb.com/?submit.707106 · [email protected]https://vuldb.com/?submit.707107 · [email protected]https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://note-hxlab.wetolink.com/share/U6cnRoRfn09r · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 DEC 23:32Z
    CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine
    cvelistv5