CVE-2025-34467 ZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pages
Authenticated low-privilege users can lock administrative pages, causing denial of service for administrators in ZwiiCMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34467?
CVE-2025-34467 is a medium-severity denial of service vulnerability in fredtempez ZwiiCMS, published on 31 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management. When an authenticated low-privilege user requests an administrative page, the application returns "404 Not Found" as expected, but incorrectly acquires and associates a temporary lock on the targeted resource with the attacker session prior to authorization. This lock prevents other users, including administrators, from accessing the affected functionality until the attacker navigates away or the session is terminated.
Which versions are affected by CVE-2025-34467?
It affects 1 product.
Products include Zwiicms Zwiicms.
How do I fix CVE-2025-34467?
No fix has been published for CVE-2025-34467 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-34467 being exploited?
There is no known exploitation of CVE-2025-34467 in the wild and no public exploit code.
Other vulnerabilities in fredtempez ZwiiCMS
Sources
Also known as GHSA-p2w9-gvcm-4px8.