{"id":"CVE-2025-60574","aliases":["EUVD-2025-38324","GHSA-6wcq-272p-hrjw"],"status":"published","title":"A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue...","description":"A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the \"/styles/\" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00487,"percentile":0.42281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-98"],"published":"2025-11-07T00:00:00Z","modified":"2026-06-17T09:49:53Z","exploits":[{"source":"pocgithub","id":"jacopoaugelli/CVE-2025-60574","title":"jacopoaugelli/CVE-2025-60574","date":"2025-11-07","url":"https://github.com/jacopoaugelli/CVE-2025-60574"}],"products":[{"vendor":"webair","product":"tquadra_cms"}],"references":[{"url":"https://github.com/jacopoaugelli/CVE-2025-60574","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60574"},{"url":"https://github.com/advisories/GHSA-6wcq-272p-hrjw"}],"sources":{"cve":[{"id":"CVE-2025-60574","description":"A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the \"/styles/\" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.","status":"published","published":"2025-11-07T00:00:00Z","modified":"2025-11-10T15:04:25.257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-98","CWE-22"],"updated_at":"2026-11-02T14:32:40.072186Z"}],"euvd":[{"id":"EUVD-2025-38324","description":"A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the \"/styles/\" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.","status":"published","published":"2025-11-07T00:00:00Z","modified":"2025-11-10T15:04:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:19.321345Z"}],"ghsa":[{"id":"GHSA-6wcq-272p-hrjw","title":"A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue...","description":"A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the \"/styles/\" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.","status":"published","published":"2025-11-08T00:31:00Z","modified":"2025-11-10T15:32:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:43.026426Z"}],"nvd":[{"id":"CVE-2025-60574","description":"A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the \"/styles/\" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.","status":"published","published":"2025-11-07T22:15:39.21Z","modified":"2026-06-17T09:49:53.61Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-98"],"updated_at":"2026-11-02T14:11:42.870953Z"}]}}