CVE-2025-52159
BaseFortify
Publication date: 2025-09-19
Last updated on: 2025-09-25
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yandaozi | ppress | 0.0.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-52159 is a vulnerability in PPress CMS version 0.0.9-beta involving hardcoded credentials in its default configuration. This issue leads to incorrect access control, allowing attackers to perform remote code execution through Server-Side Template Injection (SSTI). It is part of a chain of security flaws in PPress CMS that enable privilege escalation and remote command execution. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to gain unauthorized access to the PPress CMS system by exploiting hardcoded credentials and SSTI, leading to remote code execution. This means attackers could execute arbitrary commands on the server, potentially compromising the entire system, stealing data, or disrupting services. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no fixed version of PPress CMS 0.0.9-beta is currently available to address this vulnerability, immediate mitigation steps include disabling or restricting access to the affected PPress CMS instance, removing or changing any hardcoded credentials if possible, and monitoring for suspicious activity related to remote code execution attempts. Consider isolating the system from untrusted networks until a patch is released. [1]