CVE-2025-15250CWE-74CWE-94

08CMS Novel System Template mtpls.inc.php code injection

Medium · published December 30, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in 08CMS Novel System up to 3.4. This issue affects some unknown processing of the file admina/mtpls.inc.php of the component Template Handler. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00274 · 18.8th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-12-30T13:32Z
EPSS history
Timeline
  • 30 DEC 13:32Z
    08CMS Novel System Template mtpls.inc.php code injection
    cvelistv5