CVE-2025-15375: EyouCMS arcpagelist Ajax.php unserialize deserialization
A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component arcpagelist Handler. Executing a manipulation of the argument attstr can lead to deserialization. The attack can be launched remotely. The exploit has been published and may be used. The vendor is "[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8".
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15375?
CVE-2025-15375 is considered to be a high severity vulnerability due to its potential for remote code execution through deserialization abuse.
How do I fix CVE-2025-15375?
To fix CVE-2025-15375, upgrade your EyouCMS installation to version 1.7.8 or later, which addresses the deserialization issue.
Which versions of EyouCMS are affected by CVE-2025-15375?
CVE-2025-15375 affects EyouCMS versions up to and including 1.7.7.
What is the nature of the flaw in CVE-2025-15375?
The flaw in CVE-2025-15375 is related to improper manipulation of the unserialize function, leading to insecure deserialization vulnerabilities.
Can CVE-2025-15375 be exploited remotely?
Yes, CVE-2025-15375 can be exploited remotely, allowing attackers to execute arbitrary code on the affected system.