Description
A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. This manipulation causes protection mechanism failure. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
phome: empirecms
References7
- note-hxlab.wetolink.com/share/0x74KEtzecFb ExploitThird Party Advisory
- note-hxlab.wetolink.com/share/0x74KEtzecFb#-span--strong-proof-… ExploitThird Party Advisory
- note-hxlab.wetolink.com/share/0x74KEtzecFb ExploitThird Party Advisory
- note-hxlab.wetolink.com/share/0x74KEtzecFb#-span--strong-proof-… ExploitThird Party Advisory
- vuldb.com/?ctiid.339344 Permissions RequiredVDB Entry
- vuldb.com/?id.339344 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.721344 Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 4.0
-
5.5
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 70 · as of 11 November 2026
- CWE
- CWE-693
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.