CVE-2025-5497

slackero phpwcms Feedimport processing.inc.php deserialization

Published Jun 3, 2025 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

slackero

phpwcms

affected

Version	Status	Constraints
`1.9.0`	affected	—
`1.9.1`	affected	—
`1.9.2`	affected	—
`1.9.3`	affected	—
`1.9.4`	affected	—
`1.9.5`	affected	—
`1.9.6`	affected	—
`1.9.7`	affected	—
`1.9.8`	affected	—
`1.9.9`	affected	—
`1.9.10`	affected	—
`1.9.11`	affected	—
`1.9.12`	affected	—
`1.9.13`	affected	—
`1.9.14`	affected	—
`1.9.15`	affected	—
`1.9.16`	affected	—
`1.9.17`	affected	—
`1.9.18`	affected	—
`1.9.19`	affected	—
`1.9.20`	affected	—
`1.9.21`	affected	—
`1.9.22`	affected	—
`1.9.23`	affected	—
`1.9.24`	affected	—
`1.9.25`	affected	—
`1.9.26`	affected	—
`1.9.27`	affected	—
`1.9.28`	affected	—
`1.9.29`	affected	—
`1.9.30`	affected	—
`1.9.31`	affected	—
`1.9.32`	affected	—
`1.9.33`	affected	—
`1.9.34`	affected	—
`1.9.35`	affected	—
`1.9.36`	affected	—
`1.9.37`	affected	—
`1.9.38`	affected	—
`1.9.39`	affected	—
`1.9.40`	affected	—
`1.9.41`	affected	—
`1.9.42`	affected	—
`1.9.43`	affected	—
`1.9.44`	affected	—
`1.9.45`	affected	—
`1.10.0`	affected	—
`1.10.1`	affected	—
`1.10.2`	affected	—
`1.10.3`	affected	—
`1.10.4`	affected	—
`1.10.5`	affected	—
`1.10.6`	affected	—
`1.10.7`	affected	—
`1.10.8`	affected	—
`1.9.46`	unaffected	—
`1.10.9`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:phpwcms:phpwcms:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-16727	A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.699% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/3em0/cve_repo/blob/main/phpwcms/phar%20vulnerability%20in%20phpwcms.md
https://github.com/slackero/phpwcms/commit/41a72eca0baa9d9d0214fec97db2400bc082d2a9
https://github.com/slackero/phpwcms/releases/tag/v1.10.9
https://vuldb.com/?ctiid.310912
https://vuldb.com/?id.310912
https://vuldb.com/?submit.577999

History

Aug 20, 2025 9:00 AM Description updated. Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been declared as critical. This vulnerability affects unknown code of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. The manipulation of the argument cnt_text leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.	A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component.
Title	slackero phpwcms Feedimport Module processing.inc.php deserialization	slackero phpwcms Feedimport processing.inc.php deserialization
References		https://github.com/slackero/phpwcms/commit/41a72eca0baa9d9d0214fec97db2400bc082d2a9
Metrics	cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}`	cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Jun 13, 2025 8:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Phpwcms Phpwcms phpwcms
CPEs		cpe:2.3:a:phpwcms:phpwcms::::::::
Vendors & Products		Phpwcms Phpwcms phpwcms

Jun 3, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 3, 2025 1:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been declared as critical. This vulnerability affects unknown code of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. The manipulation of the argument cnt_text leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
Title		slackero phpwcms Feedimport Module processing.inc.php deserialization
Weaknesses		CWE-20 CWE-502
References		https://github.com/3em0/cve_repo/blob/main/phpwcms/phar%20vulnerability%20in%20phpwcms.md https://github.com/slackero/phpwcms/releases/tag/v1.10.9 https://vuldb.com/?ctiid.310912 https://vuldb.com/?id.310912 https://vuldb.com/?submit.577999
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Phpwcms Phpwcms

Weaknesses

Sources

CVE record Updated: Aug 20, 2025, 8:53 AM

Status: PUBLISHED
Assigner: VulDB
Published: Jun 3, 2025, 1:00 PM
Updated: Aug 20, 2025, 8:53 AM
Reserved: Jun 3, 2025, 5:14 AM

View source JSON

Vulnrichment Updated: Jun 3, 2025, 2:45 PM

Updated: Jun 3, 2025, 2:45 PM

JSON

NVD Updated: Jun 17, 2026, 9:48 AM

Status: Modified
Published: Jun 3, 2025, 1:15 PM
Modified: Jun 17, 2026, 9:48 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

Affected Products

Remediation

Tracking

Advisories

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

Sources

JSON object

JSON object

JSON object

JSON object

JSON object