CVE-2025-15360: newbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload
A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15360?
CVE-2025-15360 is categorized as a high-severity vulnerability due to the risk of unrestricted file uploads, which can lead to severe security breaches.
How do I fix CVE-2025-15360?
To fix CVE-2025-15360, implement strict file type validation and size limitations in the Upload functionality within the Product Information Edit Page.
What software versions are affected by CVE-2025-15360?
CVE-2025-15360 affects newbee-mall-plus version 2.0.0.
What type of vulnerability is CVE-2025-15360?
CVE-2025-15360 is an unrestricted file upload vulnerability that allows attackers to upload malicious files.
What are the potential impacts of CVE-2025-15360?
The potential impacts of CVE-2025-15360 include data compromise, unauthorized remote code execution, and full server takeovers.