Vulnerability record · CVE-2025-15187 · published 29 December 2025

CVE-2025-15187: Njtech greencms path traversal vulnerability

Njtech · Greencms

A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a manipulation of the argument sqlFiles/zipFiles results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

2.0 CVSS 4.0 Low EPSS 0.68% · top 49.3% CWE-22 · Path traversal

2.0CVSS 4.0 base score, v2 4.7

0.68%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

7References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Greencms Njtech

References

Link	Tags
https://github.com/ueh1013/VULN/issues/4	ExploitIssue TrackingThird Party Advisory
https://github.com/ueh1013/VULN/issues/5	ExploitIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.338572	Permissions RequiredVDB Entry
https://vuldb.com/?id.338572	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.721387	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.724836	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.725143	Third Party AdvisoryVDB Entry

Track CVE-2025-15187 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2018-11670Njtech greencms cross-site request forgery vulnerabilityAn issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content para…EPSS 2.5%1 Jun 2018 8.8CVE-2018-11671Njtech greencms cross-site request forgery vulnerabilityAn issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserha…EPSS 2.5%1 Jun 2018 8.1CVE-2022-28918Njtech greencms vulnerabilityGreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=.EPSS 1.1%26 Apr 2022 8.0CVE-2020-21366Njtech greencms cross-site request forgery vulnerabilityCross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php.EPSS 0.33%20 Jun 2023 7.5CVE-2018-12604Njtech greencms sensitive information in log file vulnerabilityGreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.EPSS 13%20 Jun 2018 7.1CVE-2019-25574Njtech greencms path traversal vulnerabilityGreen CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting di…EPSS 1.1%21 Mar 2026 7.1CVE-2019-25573Njtech greencms sql injection vulnerabilityGreen CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious cod…EPSS 0.34%21 Mar 2026 5.4CVE-2024-22570Njtech greencms cross-site scripting vulnerabilityA stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary we…EPSS 0.28%29 Jan 2024

Source: NIST National Vulnerability Database (record CVE-2025-15187), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.