CVE-2025-14836CWE-312CWE-313

CVE-2025-14836

Low · published December 18, 2025

CVSS v3.1
2.7
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has been published and may be used.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.8th percentile
Weaknesses
CWE-312 · Cleartext Storage of Sensitive Information; CWE-313 · Cleartext Storage in a File or on Disk
Published
2025-12-18T04:15Z
Affected products (1)
ProductVersionsFixed in
zzcms/zzcmsall versions—
References (5)
https://note-hxlab.wetolink.com/share/bu2KYevoyBm6 · [email protected]https://vuldb.com/?ctiid.336986 · [email protected]https://vuldb.com/?id.336986 · [email protected]https://vuldb.com/?submit.711654 · [email protected]https://note-hxlab.wetolink.com/share/bu2KYevoyBm6 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 DEC 23:02Z
    ZZCMS User Data Storage user_save.php cleartext storage in file
    cvelistv5