Is there a public PoC exploit available for CVE-2025-15375?

Yes, a public proof-of-concept exploit is available for CVE-2025-15375. Prioritise patching immediately. EPSS: 0.1%.

EyouCMS CVE-2025-15375

Q: What is the CVSS score of CVE-2025-15375?

CVE-2025-15375 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Input Validation (CWE-20)

2025-12-31 cna@vuldb.com

Deserialization PHP Eyoucms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible API requires low-privilege authentication; no scope change; impacts bounded to low across C/I/A consistent with limited gadget chain outcomes.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:34 vuln.today

CVE Published

Dec 31, 2025 - 05:16 cve.org

LOW 2.1

DescriptionCVE.org

A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component arcpagelist Handler. Executing a manipulation of the argument attstr can lead to deserialization. The attack can be launched remotely. The exploit has been published and may be used. The vendor is "[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8".

AnalysisAI

PHP deserialization in EyouCMS up to version 1.7.7 allows authenticated remote attackers to pass a malicious serialized payload via the attstr argument to the arcpagelist handler in application/api/controller/Ajax.php, where the application calls PHP's unserialize() on unvalidated input. A public proof-of-concept exploit has been published and is available, lowering the barrier for opportunistic attackers. The vendor has acknowledged the flaw and committed to a fix in the upcoming v1.7.8 release; no confirmed active exploitation (KEV) has been recorded, and EPSS remains at 0.06%, indicating low observed in-the-wild activity at time of analysis.

Technical ContextAI

EyouCMS is a PHP-based content management system. The vulnerable code path is within the arcpagelist handler of application/api/controller/Ajax.php, where PHP's native unserialize() function is invoked on the attacker-supplied attstr parameter without adequate input validation. This is classified under CWE-20 (Improper Input Validation), which in this context manifests as a PHP object injection (more precisely CWE-502, Deserialization of Untrusted Data - a subtype). The danger of uncontrolled PHP deserialization is that it allows an attacker to instantiate arbitrary PHP classes present in the application's loaded codebase (gadget chains), potentially chaining their magic methods (__wakeup, __destruct, __toString, etc.) to achieve unintended operations including file writes, command execution, or SSRF depending on available classes. The affected CPE is cpe:2.3:a:eyoucms:eyoucms:*:*:*:*:*:*:*:*, covering all releases through 1.7.7.

RemediationAI

The primary fix is to upgrade EyouCMS to version 1.7.8 once released, per vendor acknowledgment; this version is vendor-stated but not yet independently confirmed as available at time of analysis (see https://vuldb.com/?id.339083). As a compensating control pending the patch, restrict access to the /application/api/controller/Ajax.php endpoint at the web server or WAF layer - for example, blocking external requests to the /api/ path reduces exposure, though this may impact API-dependent features. Additionally, enforcing strict authentication controls and minimizing the number of accounts with low-privilege API access limits the attacker pool. A WAF rule inspecting the attstr parameter for serialized PHP object patterns (strings beginning with O: or a:) can provide detection and blocking capability with minimal side effects. Monitor logs for anomalous POST requests to the Ajax controller endpoint.