CVE-2025-25967

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 44th percentile

Published

2025-03-03

Updated

2025-03-04

Proof-of-concept exploits (1)

• padayali-JD/CVE-2025-259670★ · 2025-09-19

References

• CVE Record
• NVD entry

Related

• CVE-2025-22964
• CVE-2025-25968
• CVE-2026-29597
• CVE-2026-29598
• CVE-2025-25947
• CVE-2025-25946