High severity · published Dec 17, 2025
CVE-2025-14837
ZZCMS Backend Website Settings siteconfig.php stripfxg code injection
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZZ
ZZCMS · Zzcms
2025 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14837
Exploit
https://note-hxlab.wetolink.com/share/ekNgcv2wVBya
Permissions Required
https://vuldb.com/?ctiid.336987
Third Party Advisory
https://vuldb.com/?id.336987
Third Party Advisory
https://vuldb.com/?submit.711655
More from ZZCMS
9.8
CVE-2025-22957
A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication
9.8
CVE-2025-0565
ZZCMS index.php sql injection
9.8
CVE-2024-52724
ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php
9.8
CVE-2024-10293
ZZCMS functions.php Ebak_SetGotoPak unrestricted upload
9.8
CVE-2024-10292
ZZCMS ChangeTable.php unrestricted upload