CVE-2025-15110

Katalog CVE

CVSS 7.2 · High EPSS 0,37%

Kerentanan Improper Access Control pada jackq xcms. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/ProductImageController.class.php of the component Backend. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

27 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitee.com/jackq/XCMS/issues/IDC5C8 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.338481 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.711702 advisory pihak ketiga · vdb entry
• https://gitee.com/jackq/XCMS/
• https://vuldb.com/?ctiid.338481 permissions required · vdb entry