Pad Cms
Vendor:
First CVE: Sep 30, 2025 · Active for under a year
9
Total CVEs
More Total CVEs than 88% of tracked products
9.0
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
7.9
Avg CVSS
Higher Avg CVSS than 71% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Pad Cms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 30, 2025
9 months ago
Most Recent CVE
Sep 30, 2025
301 days ago
CVE Severity & Scoring
Pad Cms9 CVEs
33%
33%
33%
All CVEs353,240 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network9 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (77.8%)
Unknown0 (0.0%)
Required2 (22.2%)
Privileges Required
Low2 (22.2%)
High0 (0.0%)
None7 (77.8%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-7065CRITICAL Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type and extension withou | Sep 30, 2025 | 9.8 | 34 | NO | NO |
CVE-2025-7063CRITICAL Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without | Sep 30, 2025 | 9.8 | 30 | NO | NO |
CVE-2025-8120CRITICAL Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension withou | Sep 30, 2025 | 9.8 | 29 | NO | NO |
CVE-2025-8122HIGH Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www | Sep 30, 2025 | 8.8 | 28 | NO | NO |
CVE-2025-8121HIGH Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www | Sep 30, 2025 | 8.8 | 28 | NO | NO |
CVE-2025-8117HIGH PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects | Sep 30, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-8116MEDIUM PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in v | Sep 30, 2025 | 6.1 | 21 | NO | NO |
CVE-2025-8118MEDIUM PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the | Sep 30, 2025 | 6.5 | 20 | NO | NO |
CVE-2025-8119MEDIUM PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automati | Sep 30, 2025 | 4.3 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Pad Cms
Top CWEs
Versions
No cataloged versions.