CVE-2025-14837 ZZCMS Backend Website Settings siteconfig.php stripfxg code injection
Remote attackers with backend access can inject code via the siteconfig.php module, potentially compromising the ZZCMS web application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14837?
CVE-2025-14837 is a medium-severity code injection vulnerability in Zzcms Zzcms, published on 17 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-14837?
It affects 1 product.
Products include Zzcms Zzcms.
How do I fix CVE-2025-14837?
No fix has been published for CVE-2025-14837 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-14837 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14837 exists.
Other vulnerabilities in Zzcms Zzcms
Sources
Also known as GHSA-gp85-pqj7-66qv.