Cleartext Storage Vulnerability in ZZCMS User Data Storage Module
CVE-2025-14836

5.1MEDIUM

Key Information:

Vendor

ZZCMS

Status
Zzcms
Vendor
CVE Published:
17 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-14836?

A significant flaw exists in the ZZCMS 2025 platform affecting the User Data Storage Module, specifically within the /reg/user_save.php file. This vulnerability enables the potential for cleartext storage of sensitive data on disk, posing a severe risk of unauthorized access to user information. Remote exploitation is feasible, allowing attackers to leverage the published exploit to compromise systems and access confidential data. It is crucial for users and administrators of ZZCMS to promptly address this vulnerability to safeguard against potential data breaches.

Affected Version(s)

ZZCMS 2025

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-14836 - Proof of Concept

References

https://vuldb.com/?id.336986
vdb-entry
https://vuldb.com/?ctiid.336986
signaturepermissions-required
https://vuldb.com/?submit.711654
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

airrudder (VulDB User)
JSON
.
CVE-2025-14836 : Cleartext Storage Vulnerability in ZZCMS User Data Storage Module