CVE-2025-11138: Wenkucms Project Wenkucms

High severity, CVSS 8.8. EPSS: 4.2% chance of exploitation in the next 30 days.

A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.

Affected products

• Wenkucms Project Wenkucms: version 3.4 only

Published 2025-09-29. Last modified 2026-10-09.