SyCms CVE-2025-15130

Q: What is the CVSS score of CVE-2025-15130?

CVE-2025-15130 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-28 cna@vuldb.com

PHP Information Disclosure

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Administrator privileges required; low impact on confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:09 vuln.today

DescriptionCVE.org

A vulnerability has been found in shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921. This issue affects the function addPost of the file Application/Admin/Controller/FileManageController.class.php of the component Administrative Panel. The manipulation leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.

Technical ContextAI

The vulnerability is a CWE-74 injection flaw in the PHP-based SyCms. The affected component handles file management tasks within the admin panel, where user-supplied input to the addPost function is not properly sanitized before being used in a downstream context, enabling code injection. No CPE identifiers are provided, but the codebase is identified up to commit a242ef2d194e8bb249dc175e7c49f2c1673ec921.

Affected ProductsAI

SyCms (shanyu) using a rolling release model up to commit a242ef2d194e8bb249dc175e7c49f2c1673ec921. The project is no longer supported, and the maintainer has not responded to the reported issue. The Gitee issue IDCEWG documents the vulnerability.

RemediationAI

No vendor patch is available as the project is unmaintained. Immediate remediation is not possible. As a compensating control, restrict access to the administrative panel to trusted users and network segments only, ideally via IP whitelisting or firewall rules. This prevents remote exploitation but does not eliminate the vulnerability. Long-term, migrate to a supported content management system.