Widzialni's vulnerability footprint concentrates in Pad CMS, a modestly represented web content management platform, where disclosures cluster around structural web-application weaknesses including unrestricted file upload, SQL injection, cross-site scripting, cross-site request forgery, and brute-force authentication bypass. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes, reflecting the access and injection risks inherent to CMS platforms that handle user content and database queries. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Widzialni over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-7065CRITICAL Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type and extension withou | Sep 30, 2025 | 9.8 | 34 | NO | NO |
CVE-2025-7063CRITICAL Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without | Sep 30, 2025 | 9.8 | 30 | NO | NO |
CVE-2025-8120CRITICAL Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension withou | Sep 30, 2025 | 9.8 | 29 | NO | NO |
CVE-2025-8122HIGH Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www | Sep 30, 2025 | 8.8 | 28 | NO | NO |
CVE-2025-8121HIGH Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www | Sep 30, 2025 | 8.8 | 28 | NO | NO |
CVE-2025-8117HIGH PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects | Sep 30, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-8116MEDIUM PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in v | Sep 30, 2025 | 6.1 | 21 | NO | NO |
CVE-2025-8118MEDIUM PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the | Sep 30, 2025 | 6.5 | 20 | NO | NO |
CVE-2025-8119MEDIUM PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automati | Sep 30, 2025 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Widzialni.
Media articles that mention a CVE ID that affects a product developed by Widzialni — matched by CVE ID, not by vendor name.