CVE-2025-5424 - CVE House

Back to Database

Status published Medium CVE-2025-5424

juzaweb CMS Media Page media access control

5.3 CVSS

Vulnerability Description

A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the component Media Page. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5424

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from juzaweb

View All →

juzaweb CMS Add New Themes Page install improper authorization

juzaweb CMS Import Page imports improper authorization

juzaweb CMS Plugins Page install access control

juzaweb CMS Error Logs Page log-viewer access control

juzaweb CMS Permalinks Page permalinks access control

Affected Vendor

juzaweb

View all reports →

Affected Software

CMS

Vulnerable Versions:

3.4.0, 3.4.1, 3.4.2

Timeline

Official Publish: June 2nd, 2025

Last Modified: June 2nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-284 CWE-266

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation

T1098 Account Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Privilege Escalation

T1484 Domain or Tenant Policy Modification

Defense Evasion

T1021 Remote Services

Lateral Movement