CVE-2025-14729: Ctcms Project Ctcms

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Affected products

• Ctcms Project Ctcms: up to and including 2.1.2

Published 2025-12-15. Last modified 2026-10-07.