CVE-2025-8119 Cross-Site Request Forgery in PAD CMS
Attackers can force logged-in users to change their passwords via CSRF, leading to account takeover in the End-Of-Life PAD CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-8119?
CVE-2025-8119 is a medium-severity vulnerability in Polska Akademia Dostępności PAD CMS, published on 30 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip.
This product is End-Of-Life and producent will not publish patches for this vulnerability.
Weakness: CWE-352
Which versions are affected by CVE-2025-8119?
It affects 1 product.
Products include Widzialni Pad Cms.
How do I fix CVE-2025-8119?
No fix has been published for CVE-2025-8119 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8119 being exploited?
There is no known exploitation of CVE-2025-8119 in the wild and no public exploit code.
Other vulnerabilities in Polska Akademia Dostępności PAD CMS
- CVE-2025-7063 Remote Code Execution via Unrestricted File Upload in PAD CMS
- CVE-2025-7065 Remote Code Execution via Unrestricted File Upload in PAD CMS
- CVE-2025-8120 Remote Code Execution via Unrestricted File Upload in PAD CMS
- CVE-2025-8117 Account Takeover via Reset Password Functionality in PAD CMS
- CVE-2025-8121 Blind SQL Injection in PAD CMS
Sources
Also known as GHSA-28mw-j8x6-mf8x.