CVE-2025-1890

5.3 mediumEPSS 0.5%

Medium (5.3) in shishuocms project shishuocms. EPSS 0.5% chance of exploitation in the next 30 days.

A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWEs: CWE-284, CWE-434
Published: 2025-03-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

shishuocms_project:shishuocms

References

https://github.com/caigo8/CVE-md/blob/main/shishuocms/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
https://vuldb.com/?ctiid.298408
https://vuldb.com/?id.298408
https://vuldb.com/?submit.505736

Check your stack JSON