VULNERABILITY INTELLIGENCE

CVE-2025-14729

CVSS score7.2 HIGH

EPSS probability0.46%

CISA KEVNot currently listed

Published2025-12-15

Last modified2026-10-07

Description

A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.