Weak Client-Side Brute-Force Protection in PAD CMS by PAD Technologies
CVE-2025-8118

6.9MEDIUM

Key Information:

Vendor

Polska Akademia Dostępności

Status
Pad Cms
Vendor
CVE Published:
30 September 2025

What is CVE-2025-8118?

PAD CMS suffers from a serious vulnerability related to insufficient client-side brute-force protection. The system relies on two cookies—login_count and login_timeout—to track login attempts. However, neither of these data points is stored on the server, leaving the system open to exploitation. Attackers can manipulate these cookies to reset their login attempts, effectively bypassing any brute-force protection mechanisms in place. It is important to note that this product is End-Of-Life, meaning that no patches or updates will be provided to address this vulnerability.

Affected Version(s)

PAD CMS 0 <= 1.2.1

References

https://cert.pl/posts/2025/09/CVE-2025-7063

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mateusz Jurczak (CERT.PL)
JSON
.
CVE-2025-8118 : Weak Client-Side Brute-Force Protection in PAD CMS by PAD Technologies