CVE-2025-3842CWE-74CWE-94
panhainan DS-Java FileUpload.java uploadUserPic.action code injection
Medium · published April 21, 2025
What it is
A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. This issue affects the function uploadUserPic.action of the file src/com/phn/action/FileUpload.java. The manipulation of the argument fileUpload leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
The record
Technical detail
- CVSS v4.0
- 5.3 · MEDIUM
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00712 · 53.0th percentile
- Weaknesses
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2025-04-21T20:31Z
EPSS history
Timeline