CVE-2025-14729

A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Score

CVSS 3.1 7.2 High

Status

Analyzed - cna@vuldb.com

Published

2025-12-15

Last modified

2026-10-07

Weaknesses

CWE-74, CWE-94

Affected products

• Content Management System (Ctcms)
• Ctcms (Ctcms Project)

References

• https://vuldb.com/?id.336486
• https://vuldb.com/?ctiid.336486
• https://vuldb.com/?submit.707104
• https://note-hxlab.wetolink.com/share/R3y6uiOuuYbA