CVE-2025-10116: SiempreCMS file_upload.php unrestricted upload

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-09 · updated 2026-10-19
Weakness: CWE-284

Description

A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used.

Affected products

SiempreCMS: 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5 (+1)

References

https://github.com/drew-byte/SiempreCMS-File-Upload-Abuse/blob/main/README.md
https://vuldb.com/?ctiid.323085
https://vuldb.com/?id.323085
https://vuldb.com/?submit.645540

Get alerted when CVE-2025-10116 or the next vulnerability affects your stack