CVE-2025-15153

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15153", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-12-27T16:47:06.711Z", "datePublished": "2025-12-28T20:32:07.587Z", "dateUpdated": "2026-02-24T06:08:08.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T06:08:08.429Z"}, "title": "PbootCMS SQLite Database pbootcms.db file access", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-552", "lang": "en", "description": "Files or Directories Accessible"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-425", "lang": "en", "description": "Direct Request"}]}], "affected": [{"vendor": "n/a", "product": "PbootCMS", "versions": [{"version": "3.2.0", "status": "affected"}, {"version": "3.2.1", "status": "affected"}, {"version": "3.2.2", "status": "affected"}, {"version": "3.2.3", "status": "affected"}, {"version": "3.2.4", "status": "affected"}, {"version": "3.2.5", "status": "affected"}, {"version": "3.2.6", "status": "affected"}, {"version": "3.2.7", "status": "affected"}, {"version": "3.2.8", "status": "affected"}, {"version": "3.2.9", "status": "affected"}, {"version": "3.2.10", "status": "affected"}, {"version": "3.2.11", "status": "affected"}, {"version": "3.2.12", "status": "affected"}], "cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "modules": ["SQLite Database"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. Modifying the configuration settings is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR"}}], "timeline": [{"time": "2025-12-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-12-27T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-12-31T06:16:27.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "pemic (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.338531", "name": "VDB-338531 | PbootCMS SQLite Database pbootcms.db file access", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.338531", "name": "VDB-338531 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.719814", "name": "Submit #719814 | PbootCMS 3.2.12 SQLite Database File Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://note-hxlab.wetolink.com/share/ALC1iSa8J56A", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-29T14:55:43.372967Z", "id": "CVE-2025-15153", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-29T14:55:49.904Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15153", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-29T14:55:43.372967Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-29T14:55:47.285Z"}}], "cna": {"title": "PbootCMS SQLite Database pbootcms.db file access", "credits": [{"lang": "en", "type": "reporter", "value": "pemic (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["SQLite Database"], "product": "PbootCMS", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}, {"status": "affected", "version": "3.2.6"}, {"status": "affected", "version": "3.2.7"}, {"status": "affected", "version": "3.2.8"}, {"status": "affected", "version": "3.2.9"}, {"status": "affected", "version": "3.2.10"}, {"status": "affected", "version": "3.2.11"}, {"status": "affected", "version": "3.2.12"}]}], "timeline": [{"lang": "en", "time": "2025-12-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-12-27T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-12-31T06:16:27.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.338531", "name": "VDB-338531 | PbootCMS SQLite Database pbootcms.db file access", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.338531", "name": "VDB-338531 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.719814", "name": "Submit #719814 | PbootCMS 3.2.12 SQLite Database File Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://note-hxlab.wetolink.com/share/ALC1iSa8J56A", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. Modifying the configuration settings is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "Files or Directories Accessible"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-425", "description": "Direct Request"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T06:08:08.429Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15153", "state": "PUBLISHED", "dateUpdated": "2026-02-24T06:08:08.429Z", "dateReserved": "2025-12-27T16:47:06.711Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-12-28T20:32:07.587Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "modules": ["SQLite Database"], "product": "PbootCMS", "vendor": "n/a", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}, {"status": "affected", "version": "3.2.6"}, {"status": "affected", "version": "3.2.7"}, {"status": "affected", "version": "3.2.8"}, {"status": "affected", "version": "3.2.9"}, {"status": "affected", "version": "3.2.10"}, {"status": "affected", "version": "3.2.11"}, {"status": "affected", "version": "3.2.12"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*", "matchCriteriaId": "56085BF1-065B-4EB2-B608-478B1685756A", "versionEndIncluding": "3.2.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. Modifying the configuration settings is advised."}, {"lang": "es", "value": "Se ha identificado una debilidad en PbootCMS hasta la versi\u00f3n 3.2.12. Afecta a una funci\u00f3n desconocida del archivo /data/pbootcms.db del componente base de datos SQLite. La ejecuci\u00f3n de manipulaci\u00f3n puede llevar a archivos o directorios accesibles. Es posible lanzar el ataque de forma remota. Los ataques de esta naturaleza son altamente complejos. La explotabilidad se considera dif\u00edcil. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser explotado. Se aconseja modificar la configuraci\u00f3n."}], "id": "CVE-2025-15153", "lastModified": "2026-10-13T09:10:00.323", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15153", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-29T14:55:43.372967Z", "version": "2.0.3"}}]}, "published": "2025-12-28T21:15:54.107", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://note-hxlab.wetolink.com/share/ALC1iSa8J56A"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.338531"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.338531"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.719814"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-425"}, {"lang": "en", "value": "CWE-552"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-425"}, {"lang": "en", "value": "CWE-552"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-12-29T22:33:15.866083+00:00", "updated": "2025-12-29T22:33:15.866122+00:00", "vendors": ["pbootcms", "pbootcms$PRODUCT$pbootcms"]}