medium4.7
CVE-2025-14729
A vulnerability was identified in CTCMS Content Management System up to 2.1.2.
Impact
A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ctcms Project | Ctcms | through 2.1.2 |