CVE-2025-14730: Ctcms Project Ctcms

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_Config.php of the component Backend System Configuration Module. The manipulation of the argument Cj_Add/Cj_Edit results in code injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.

Affected products

• Ctcms Project Ctcms: up to and including 2.1.2

Published 2025-12-15. Last modified 2026-10-07.