CVE-2024-32162
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
CMSeasy version 7.7.7.9 is vulnerable to arbitrary file deletion. An attacker can exploit this vulnerability to delete critical system files.
Risk Assessment
The risk involves the potential deletion of configuration files, data, or application files, which could lead to system downtime or data loss.
Recommendation
It is recommended to immediately update CMSeasy to the latest available version that fixes this vulnerability. If an update is not possible, restrict access to the system and monitor logs for suspicious file deletion operations.
Other vulnerabilities in CMSeasy
See all- CVE-2025-15148Medium
A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2025-11332Low
A cross-site scripting (XSS) vulnerability was found in CmsEasy up to version 7.7.7 in the lib/inc/view.php library of the URL Handler component. Manipulating the PHP_SELF argument can lead to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Original NVD description (English source)
CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS