Is there a public PoC exploit available for CVE-2025-15393?

Yes, a public proof-of-concept exploit is available for CVE-2025-15393. Prioritise patching immediately. EPSS: 0.1%.

KodiCMS CVE-2025-15393

Q: What is the CVSS score of CVE-2025-15393?

CVE-2025-15393 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-31 cna@vuldb.com

PHP Information Disclosure Kodicms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

PHP code injection classically enables full server compromise; PR:L confirmed by CVSS 4.0 vector, though CNA's low-impact rating warrants independent POC verification.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:34 vuln.today

CVE Published

Dec 31, 2025 - 19:15 cve.org

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/model/file.php of the component Layout API Endpoint. The manipulation of the argument content leads to code injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the content argument of the Save function in file.php to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.

Technical ContextAI

KodiCMS is a PHP content management system built atop the Kohana framework, a lightweight MVC PHP framework. The vulnerable component is the Layout API endpoint backed by the model class at cms/modules/kodicms/classes/kodicms/model/file.php, specifically its Save method, which processes a user-supplied content parameter without adequate sanitization. The CPE cpe:2.3:a:kodicms-kohana:kodicms:*:*:*:*:*:*:*:* covers all known versions up to 13.82.135. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), a broad category encompassing scenarios where attacker-controlled data is interpreted as code or instructions by the application runtime. In a PHP context, this pattern typically arises from unsafe use of eval(), preg_replace with the deprecated /e modifier, or unsanitized content being written to an executable or interpreted file. The 'Information Disclosure' tag alongside 'code injection' suggests the injection may produce observable output, whether or not it achieves full arbitrary command execution.

RemediationAI

No vendor-released patch is available at time of analysis - the vendor was contacted early and did not respond, leaving no official fix or version to upgrade to. As the primary compensating control, restrict access to the Layout API endpoint (the Save method in file.php) via web application firewall rules or web server ACL configuration to allow only fully trusted administrative accounts, noting this may break legitimate layout-editing workflows for lower-privilege editors. Tighten KodiCMS role assignments so that the Layout API is inaccessible to general authenticated users, reducing PR:L exploitation to only accounts under strict operational control. If the CMS is internet-facing, consider placing it behind a VPN or IP allowlist to eliminate remote attack surface entirely, accepting the operational trade-off of reduced accessibility. Deploy file-integrity monitoring on the CMS installation directory to detect unauthorized writes as a post-exploitation indicator. Monitor the VulDB entry at https://vuldb.com/?id.339162 and any upstream KodiCMS/Kohana community repositories for community-issued patches, as no official vendor channel is active.