CVE-2025-15375 | EyouCMS up to 1.7.7 arcpagelist Ajax.php unserialize attstr deserialization

A vulnerability, which was classified as critical, was found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component arcpagelist Handler. Executing manipulation of the argument attstr can lead to deserialization.

This vulnerability is tracked as CVE-2025-15375. The attack can be launched remotely. Moreover, an exploit is present.

The vendor is “[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8”.