---
id: CVE-2025-14837
title: A vulnerability has been found in ZZCMS 2025
summary: >-
  A vulnerability has been found in ZZCMS 2025. Affected by this issue is the
  function stripfxg of the file /admin/siteconfig.php of the component Backend
  Website Settings Module. Such manipulation of the argument icp leads to code
  injecti…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-74
  - CWE-94
vendor: zzcms
product: zzcms
affected:
  - zzcms = 2025
published: '2025-12-18'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14837'
references:
  - url: 'https://note-hxlab.wetolink.com/share/ekNgcv2wVBya'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.336987'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.336987'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.711655'
    label: cna@vuldb.com
  - url: 'https://note-hxlab.wetolink.com/share/ekNgcv2wVBya'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00458
epssPercentile: 0.37872
ingestedAt: '2026-10-13T11:23:51.131Z'
---

## Overview

A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

## Affected

- `zzcms = 2025`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.