{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-27T04:09:12.718","vulnerabilities":[{"cve":{"id":"CVE-2025-55044","sourceIdentifier":"cve@mitre.org","published":"2026-03-18T16:16:23.550","lastModified":"2026-06-17T09:41:09.647","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF. The vulnerable cTrash.restore function lacks CSRF token validation, enabling malicious websites to forge requests that restore content to arbitrary parent locations when an authenticated administrator visits a crafted webpage. Successful exploitation of the Trash Restore CSRF vulnerability results in unauthorized restoration of deleted content to potentially inappropriate or malicious locations within the MuraCMS website structure. When an authenticated administrator visits a malicious webpage containing the CSRF exploit, their browser automatically submits a hidden form that restores specified content from the trash to a location determined by the attacker through the parentid parameter. This can lead to restoration of previously deleted malicious content, placement of sensitive documents in public areas, manipulation of website navigation structure, or restoration of outdated content that was intentionally removed for security or compliance reasons."},{"lang":"es","value":"La vulnerabilidad CSRF de restauración de papelera en MuraCMS hasta la versión 10.1.10 permite a los atacantes restaurar contenido eliminado de la papelera a ubicaciones no autorizadas a través de CSRF. La función vulnerable cTrash.restore carece de validación de token CSRF, lo que permite a sitios web maliciosos falsificar solicitudes que restauran contenido a ubicaciones padre arbitrarias cuando un administrador autenticado visita una página web manipulada. La explotación exitosa de la vulnerabilidad CSRF de restauración de papelera resulta en la restauración no autorizada de contenido eliminado a ubicaciones potencialmente inapropiadas o maliciosas dentro de la estructura del sitio web de MuraCMS. Cuando un administrador autenticado visita una página web maliciosa que contiene el exploit CSRF, su navegador envía automáticamente un formulario oculto que restaura contenido especificado de la papelera a una ubicación determinada por el atacante a través del parámetro parentid. Esto puede llevar a la restauración de contenido malicioso previamente eliminado, la colocación de documentos sensibles en áreas públicas, la manipulación de la estructura de navegación del sitio web o la restauración de contenido obsoleto que fue eliminado intencionalmente por razones de seguridad o cumplimiento."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-19T13:50:51.206366Z","id":"CVE-2025-55044","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:murasoftware:mura_cms:-:*:*:*:*:*:*:*","matchCriteriaId":"CB4646EE-1255-4B42-890A-E0B57EBFE2CE"}]}]}],"references":[{"url":"https://docs.murasoftware.com/v10/release-notes/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://docs.murasoftware.com/v10/release-notes/#section-version-1014","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://www.murasoftware.com","source":"cve@mitre.org","tags":["Product"]}]}}]}