CVE-2025-67173
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
Risk Assessment
An authenticated user may unknowingly create unwanted pages on their behalf, potentially leading to content modification or publication of malicious material.
Recommendation
Update RiteCMS to a patched version or implement anti-CSRF tokens for page creation and editing operations. Additionally, consider enforcing the SameSite attribute for session cookies.
Other vulnerabilities in RiteCMS
See all- CVE-2025-67174High
A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via directory traversal in the admin_language_file and default_page_language_file parameters in the admin.php component.
- CVE-2025-67171High
Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal. The vulnerability enables reading files outside the intended directory.
- CVE-2025-67168Medium
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
- CVE-2025-67172High
RiteCMS v3.1.0 has an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.
Original NVD description (English source)
A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS