Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.0
CVE-2025-25968: Acora CMS version 10.1.1 Exposes Admin Credentials to Editor Users
CVE-2025-25968 · published 1 year ago
Summary
A vulnerability in Acora CMS version 10.1.1 allows an editor user to access sensitive system administrator credentials, potentially allowing the attacker to take over the system or elevate their privileges. This can happen if an attacker knows the correct file names to request. To protect your system, update to a fixed version of Acora CMS or restrict access to sensitive files.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ddsn | cm3_acora_content_management_system |
10.1.1 cpe:2.3:a:ddsn:cm3_acora_content_management_system:10.1.1:*:*:*:*:*:*:* |
Original advisory text
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials...
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.
References
- http://ddsn.com Product
- https://github.com/padayali-JD/CVE-2025-25968 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-284Improper Access Control
Timeline
Published20 Feb 2025
Updated3 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta