Sanluan PublicCMS CVE-2025-7949
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named c1e79f124e3f4c458315d908ed7dee06f9f12a76/f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue.
AnalysisAI
Open redirect vulnerability in Sanluan PublicCMS up to version 5.202506.a allows authenticated remote attackers with low privileges to redirect users to arbitrary external URLs via manipulation of the url parameter in the admin preview functionality. The vulnerability requires user interaction (clicking a malicious link) and impacts integrity but not confidentiality or availability. Publicly available exploit code exists, and vendor patches are available.
Technical ContextAI
The vulnerability exists in the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html, a server-side template that processes user-supplied URL parameters without proper validation. This is a classic open redirect vulnerability (CWE-601) where attacker-controlled input flows directly into a redirect operation without verification that the destination is within the application's trusted domain. The affected component is part of the admin content management interface, indicating the vulnerability requires authenticated access to the admin panel. The CVSS vector (AV:N/AC:L) indicates network-based exploitation with low complexity, but the PR:L and UI:P constraints mean an authenticated user with low privileges must be involved and a targeted user must click a malicious link.
RemediationAI
Apply the vendor-released patch from GitHub commit c1e79f124e3f4c458315d908ed7dee06f9f12a76 (or the follow-up commit f1af17af004ca9345c6fe4d5936d87d008d26e75) to remediate the open redirect. Review the patch in the PublicCMS repository at https://github.com/sanluan/PublicCMS/commit/c1e79f124e3f4c458315d908ed7dee06f9f12a76 to understand the fix implementation. As a compensating control prior to patching, restrict admin panel access via IP allowlist or VPN, reducing the attack surface to authenticated administrators on trusted networks. Additionally, implement Content Security Policy (CSP) headers with default-src 'self' to limit redirect scope and educate administrative users to verify URLs before clicking links in CMS preview contexts. These controls do not eliminate the vulnerability but significantly reduce exploitation probability.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today