CVE-2020-25557: In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username...

Security readout for executives and security teams

CVE-2020-25557 is a reported CMSuno 1.6.2 flaw where a logged-in user can put PHP code into a username change. When that account logs in again, the code can run on the server, potentially giving the user command execution. Exposure appears limited to CMSuno 1.6.2 installations where attackers can authenticate and change account details. Internet-facing sites with weak, shared, or compromised CMSuno accounts carry higher operational risk. Treat this as high priority if CMSuno 1.6.2 is deployed. The impact is server command execution, but exploitation requires authentication based on the available sources. Mitigation focus: Inventory any CMSuno deployments and confirm whether version 1.6.2 is present.; Check CMSuno vendor or project guidance for an upgrade or supported remediation.; Restrict access to authenticated CMSuno areas until remediation is confirmed..

Prepared

Jun 3, 2026, 04:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.