CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-05-07
Craft CMS Session Poisoning to Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-35939)
[Affected Scope] Craft CMS versions prior to 4.15.3 and 5.7.5
[Impact] Unauthenticated attackers can inject arbitrary PHP code into session files, potentially leading to Remote Code Execution (RCE) when chained with an independent local file inclusion vulnerability.
[Mitigation] Immediately upgrade Craft CMS to the patched versions (4.15.3, 5.7.5, or higher).