CVE-2025-25967HIGH 8.8EPSS p38.6%

CVE-2025-25967CVE-2025-25967

Description

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS0.50% probability of exploitation · percentile 38.6% · 2026-06-18T12:00:27Z
Published2025-03-03
Last modified2025-03-06

Underlying weaknesses· 1

CWE-352

References

  1. https://github.com/padayali-JD/CVE-2025-25967

1

TypeTargetConfidenceTier
WeaknessCross-Site Request Forgery (CSRF)cwe-3520%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-39170
CVE
CVE-2025-22964
CVE
CVE-2025-14472
CVE
CVE-2025-63314
CVE
CVE-2025-28091
CVE
CVE-2025-28862
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.