CVE-2025-34467
MEDIUM EPSS 8.8%
Published Dec 31, 20256mo ago · Modified Jun 17, 20261w ago
5.3 CVSS 4.0
Published Dec 31, 2025 6mo ago
Last Modified Jun 17, 2026 1w ago
Description
ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management. When an authenticated low-privilege user requests an administrative page, the application returns "404 Not Found" as expected, but incorrectly acquires and associates a temporary lock on the targeted resource with the attacker session prior to authorization. This lock prevents other users, including administrators, from accessing the affected functionality until the attacker navigates away or the session is terminated.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
8.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-667
CWE-863 Incorrect Authorization Authorization
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| zwiicms | zwiicms | * | <13.7.00 |
References 3
- codeberg.org https://codeberg.org/fredtempez/ZwiiCMS/releases/tag/13.7.00
- github.com https://github.com/fredtempez/ZwiiCMS
- vulncheck.com https://www.vulncheck.com/advisories/zwiicms-lock-persistence-authenticated-dos-against-administrative-pages
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.