CVE-2025-15422
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
A flaw was found in EmpireSoft EmpireCMS up to 8.0 in the egetip function of the file e/class/connect.php in the IP Address Handler component. Manipulation causes protection mechanism failure. The attack can be initiated remotely, and the exploit has been published.
Risk Assessment
The organization may be exposed to remote bypass of security controls, potentially leading to unauthorized access or system integrity compromise.
Recommendation
Apply available patches or update EmpireCMS to the latest version immediately, and monitor the system for suspicious activity.
Other vulnerabilities in EmpireCMS
See all- CVE-2026-121929Low
A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0 affecting an unknown function of the file /e/member/mspace/index.php. Manipulation of the spacename argument results in cross site scripting. The attack can be launched remotely, and the exploit has been released publicly and may be used in attacks.
- CVE-2025-15423Medium
A vulnerability was found in EmpireSoft EmpireCMS up to 8.0 in the CheckSaveTranFiletype function of the file e/class/connect.php, allowing unrestricted upload. The attack can be launched remotely, and the exploit has been disclosed publicly.
Original NVD description (English source)
A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. This manipulation causes protection mechanism failure. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS