CVE-2025-52130

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller

Medium · published August 25, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.2th percentile
Published
2025-08-25T00:00Z
EPSS history
Timeline
  • 25 AUG 00:00Z
    File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller
    cvelistv5