CVE-2020-25262

PyroCMS Vulnerable to CSRF

4.3 Medium

CVE-2020-25262 is a medium vulnerability (CVSS 4.3) in Pyrocms, published October 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. No source names a fixed version.

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.53%Down 0.3 points since Apr 14, 2021

What each source reports

NVD Score used 4.3

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

Record: CVE-2020-25262
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

Record: CVE-2020-25262
Updated: 2026-11-02

EUVDEUVD-2022-2515 No score

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

Record: EUVD-2022-2515
Updated: 2026-11-03

GitHub AdvisoriesGHSA-56xx-pv88-2662 4.3

PyroCMS Vulnerable to CSRF

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

Record: GHSA-56xx-pv88-2662
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSV 4.3

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

Record: CVE-2020-25262
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-56xx-pv88-2662 4.3

PyroCMS Vulnerable to CSRF

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

Record: GHSA-56xx-pv88-2662
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-352
Updated: 2026-11-02

Affected products

pyrocms

Affected packages

Affected packages
Package	Affected	Fixed
`pyrocms/pyrocms` Packagist	through 3.7	None known
`pyrocms/pyrocms` Packagist	through 3.7, plus listed versions 3.0.0-alpha13.0.0-alpha23.4.11v2.3.0-alpha1v2.3.0-beta1 Show 45 moreShow less v3.0.0v3.0.0-beta1v3.0.0-beta2v3.0.0-beta3v3.0.0-rc1v3.0.0-rc2v3.0.1v3.0.2v3.1.0v3.1.1v3.1.2v3.1.3v3.1.4v3.1.5v3.2.0v3.2.1v3.2.2v3.2.3v3.3.0v3.3.1v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.1v3.4.10v3.4.12v3.4.13v3.4.14v3.4.15v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v3.5.0v3.5.1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 8 versions. The JSON record has them.