CVE-2025-14532

Remote Code Execution via Unrestricted File Upload in DobryCMS

CVSS 9.3 CRITICALEPSS 0.5%CWE-434

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

02 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Produtos afetados

Studio Fabryka · DobryCMS

Referências

https://cert.pl/posts/2026/03/CVE-2025-12462/