CVE-2025-29150

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-29150
BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://gist.github.com/electroN1chahaha/054a1af22157aa3010e89b3103ad7b9a Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bluecms_project:bluecms:1.6:*:*:*:*:*:*:*
History

15 Apr 2025, 13:50

Type Values Removed Values Added
References () https://gist.github.com/electroN1chahaha/054a1af22157aa3010e89b3103ad7b9a - () https://gist.github.com/electroN1chahaha/054a1af22157aa3010e89b3103ad7b9a - Exploit, Third Party Advisory
First Time Bluecms Project bluecms
Bluecms Project
CPE cpe:2.3:a:bluecms_project:bluecms:1.6:*:*:*:*:*:*:*

11 Apr 2025, 15:39

Type Values Removed Values Added
Summary
  • (es) BlueCMS 1.6 sufre eliminación arbitraria de archivos a través del parámetro id en una solicitud /publish.php?act=del.

10 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-10 15:16

Updated : 2025-04-15 13:50

NVD link : CVE-2025-29150

Mitre link : CVE-2025-29150

CVE.ORG link : CVE-2025-29150

JSON object : View

Products Affected

bluecms_project

  • bluecms
CWE
CWE-20

Improper Input Validation