CVE-2025-6001 — VirtueMart - Cross Site Request Forgery (CSRF)

CVE-2025-6001

VirtueMart - Cross Site Request Forgery (CSRF) PUBLISHED

Description (CNA)

A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacker is able to craft a special CSRF request which will allow unrestricted file upload into the VirtueMart media manager.

Affected (CNA)

Vendor / product	Versions
VirtueMart / VirtueMart	affected 3.0.0 before 4.4.10

CWE

CWE-352

References

https://blog.blacklanternsecurity.com/p/doomla-zero-days

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.