{"id":"CVE-2025-5498","summary":"slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization","details":"A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpage_custom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.","modified":"2026-10-22T10:34:54.937433657Z","published":"2025-06-03T13:31:05.263Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-20","CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5498.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.0"},{"last_affected":"1.9.0"},{"introduced":"1.9.1"},{"last_affected":"1.9.1"},{"introduced":"1.9.4"},{"last_affected":"1.9.4"},{"introduced":"1.9.9"},{"last_affected":"1.9.9"},{"introduced":"1.9.10"},{"last_affected":"1.9.10"},{"introduced":"1.9.14"},{"last_affected":"1.9.14"},{"introduced":"1.9.31"},{"last_affected":"1.9.31"},{"introduced":"1.10.0"},{"last_affected":"1.10.0"},{"introduced":"1.10.1"},{"last_affected":"1.10.1"}]}]}]},"references":[{"type":"WEB","url":"https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23file_get_contents.md"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5498.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5498"},{"type":"ADVISORY","url":"https://vuldb.com/?id.310913"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.578054"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.578055"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.310913"},{"type":"FIX","url":"https://github.com/slackero/phpwcms/releases/tag/v1.10.9"},{"type":"EVIDENCE","url":"https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23is_file.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/slackero/phpwcms","events":[{"introduced":"989ad0fef69272f3f9e61ff854ec5f796242e329"},{"fixed":"d6f8c5c7df18158f6c6d762cc3883b53783c9028"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.2"},{"last_affected":"1.9.2"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.3"},{"last_affected":"1.9.3"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.5"},{"last_affected":"1.9.5"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.6"},{"last_affected":"1.9.6"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.7"},{"last_affected":"1.9.7"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.8"},{"last_affected":"1.9.8"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.11"},{"last_affected":"1.9.11"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.12"},{"last_affected":"1.9.12"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.13"},{"last_affected":"1.9.13"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.15"},{"last_affected":"1.9.15"}]},{"range":[{"introduced":"1.9.16"},{"last_affected":"1.9.16"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.17"},{"last_affected":"1.9.17"}]},{"range":[{"introduced":"1.9.18"},{"last_affected":"1.9.18"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.19"},{"last_affected":"1.9.19"}]},{"range":[{"introduced":"1.9.20"},{"last_affected":"1.9.20"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.21"},{"last_affected":"1.9.21"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.22"},{"last_affected":"1.9.22"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.23"},{"last_affected":"1.9.23"}]},{"range":[{"introduced":"1.9.24"},{"last_affected":"1.9.24"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"1.9.25"},{"last_affected":"1.9.25"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"1.9.26"},{"last_affected":"1.9.26"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.27"},{"last_affected":"1.9.27"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.28"},{"last_affected":"1.9.28"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.29"},{"last_affected":"1.9.29"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.30"},{"last_affected":"1.9.30"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.32"},{"last_affected":"1.9.32"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.33"},{"last_affected":"1.9.33"}]},{"range":[{"introduced":"1.9.34"},{"last_affected":"1.9.34"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.35"},{"last_affected":"1.9.35"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"1.9.36"},{"last_affected":"1.9.36"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.37"},{"last_affected":"1.9.37"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.38"},{"last_affected":"1.9.38"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.39"},{"last_affected":"1.9.39"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"1.9.40"},{"last_affected":"1.9.40"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"1.9.41"},{"last_affected":"1.9.41"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.42"},{"last_affected":"1.9.42"}]},{"range":[{"introduced":"1.9.43"},{"last_affected":"1.9.43"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.9.44"},{"last_affected":"1.9.44"}]},{"range":[{"introduced":"1.9.45"},{"last_affected":"1.9.45"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.10.2"},{"last_affected":"1.10.2"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.10.3"},{"last_affected":"1.10.3"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.10.4"},{"last_affected":"1.10.4"}]},{"range":[{"introduced":"1.10.5"},{"last_affected":"1.10.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.10.6"},{"last_affected":"1.10.6"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.10.7"},{"last_affected":"1.10.7"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.10.8"},{"last_affected":"1.10.8"}]},{"range":[{"fixed":"d6f8c5c7df18158f6c6d762cc3883b53783c9028"}],"source":"REFERENCES_TAG","original_tag":"v1.10.9"}]}}],"versions":["1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.9.11","1.9.12","1.9.13","1.9.15","1.9.16","1.9.17","1.9.18","1.9.19","1.9.2","1.9.20","1.9.21","1.9.22","1.9.23","1.9.24","1.9.25","1.9.26","1.9.27","1.9.28","1.9.29","1.9.3","1.9.30","1.9.32","1.9.33","1.9.34","1.9.35","1.9.36","1.9.37","1.9.38","1.9.39","1.9.40","1.9.41","1.9.42","1.9.43","1.9.44","1.9.45","1.9.5","1.9.6","1.9.7","1.9.8","v1.10.8","v1.10.7","v1.10.6","v1.10.5","v1.10.4","v1.10.3","v1.10.2","v1.9.38","v1.9.37","v1.9.36","v1.9.35","v1.9.34","v1.9.33","v1.9.32","v1.9.30","v1.9.29","v1.9.28","v1.9.27","v1.9.26","v1.9.25","v1.9.24","v1.9.23","v1.9.22","v1.9.21","v1.9.20","v1.9.19","v1.9.18","v1.9.17","v1.9.16","v1.9.15","v1.9.13","v1.9.12","v1.9.11","v1.9.8","v1.9.7","phpwcms-1.9.6","phpwcms-1.9.5","phpwcms-1.9.3","phpwcms-1.9.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-5498.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}