CVE-2025-15393HIGH 8.8EPSS p29.0%

CVE-2025-15393CVE-2025-15393

Description

A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/model/file.php of the component Layout API Endpoint. The manipulation of the argument content leads to code injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS0.37% probability of exploitation · percentile 29.0% · 2026-06-18T12:00:27Z
Published2025-12-31
Last modified2026-04-29

Underlying weaknesses· 2

CWE-74CWE-94

References

  1. https://vuldb.com/?ctiid.339162
  2. https://vuldb.com/?id.339162
  3. https://vuldb.com/?submit.718290
  4. https://vuldb.com/?submit.718290

2

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')cwe-740%live
WeaknessImproper Control of Generation of Code ('Code Injection')cwe-940%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-15392
CVE
CVE-2025-65602
CVE
CVE-2025-3969
CVE
CVE-2025-4291
CVE
CVE-2025-9415
CVE
CVE-2025-25515
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.