CVE-2025-4768CWE-284CWE-434

feng_ha_ha/megagao ssm-erp/production_ssm PictureServiceImpl.java uploadPicture unrestricted upload

Medium · published May 16, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file PictureServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00329 · 24.8th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-05-16T10:00Z
EPSS history
Timeline
  • 16 MAY 10:00Z
    feng_ha_ha/megagao ssm-erp/production_ssm PictureServiceImpl.java uploadPicture unrestricted upload
    cvelistv5