CVE-2025-14729: CTCMS Content Management System Backend App Configuration Ct_App.php save code injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-15 · updated 2026-10-07
Weakness: CWE-74

Description

A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Affected products

Ctcms: through 2.1.2

References

https://note-hxlab.wetolink.com/share/R3y6uiOuuYbA
https://vuldb.com/?ctiid.336486
https://vuldb.com/?id.336486
https://vuldb.com/?submit.707104
https://note-hxlab.wetolink.com/share/R3y6uiOuuYbA

Get alerted when CVE-2025-14729 or the next vulnerability affects your stack