Vulnerability · Published Sep 30, 2025 · Assigned by CERT-PL

CVE-2025-8118Bruteforce Protection Bypass in PAD CMS

Medium 6.9

In plain English

A medium-severity security flaw in PAD CMS from Polska Akademia Dostępności. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.2%top 87.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Polska Akademia Dostępności	PAD CMS	0 – through 1.2.1

Weakness: CWE-307 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/posts/2025/09/CVE-2025-7063