CVE-2025-55743CWE-434

UnoPim vulnerable to remote code execution through Arbitrary File upload

High · published August 21, 2025

CVSS v4.0
7.3
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The vulnerability is fixed in 0.2.1.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00478 · 40.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-08-21T15:45Z
EPSS history
Timeline
  • 21 AUG 15:45Z
    UnoPim vulnerable to remote code execution through Arbitrary File upload
    cvelistv5