Vulnerability · Published Sep 30, 2025 · Assigned by CERT-PL
CVE-2025-8116Reflected XSS in PAD CMS
Medium 5.1
In plain English
A medium-severity cross-site scripting in PAD CMS from Polska Akademia Dostępności. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in victim's browser, when opened. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Polska Akademia Dostępności | PAD CMS | 0 – through 1.2.1 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N