CVE-2025-2043 MEDIUM

CVE-2025-2043: LinZhaoguan pb-cms Add New Topic admin#themes deserialization

Vendor Linzhaoguan

Product pb-cms

Weakness CWE-502 · Unsafe deserialization

Published March 6, 2025

Last update March 6, 2025

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

March 6, 2025 CVE published

March 6, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-2043

Related vulnerabilities

04Related CVE

CVE-2021-21349 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host CVE-2025-49507 WordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability CVE-2025-69099 WordPress North theme <= 5.7.5 - PHP Object Injection vulnerability CVE-2026-39532 WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability CVE-2025-43848 GHSL-2025-018_Retrieval-based-Voice-Conversion-WebUI