CVE-2025-14532

critical · 9.3

DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.

9.3

CVSS

0.5%

EPSS (exploit prob.)

44th

EPSS percentile

2026-03-02

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
studiofabryka	dorbycms	>= 1.0, <= 5.0

Check a specific version with /api/v1/cve/match.

References

https://cert.pl/posts/2026/03/CVE-2025-12462/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-14532