CVE-2025-25772: A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator…

PriorityP419medium5.1CVSS 3.1

AVLACLPRNUINSUCLILAN

EPSS

0.16%

5.8th percentile

A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ujcms	jspxcms	9.0.0 – 9.5.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.