CVE-2025-52130

5.4 mediumEPSS 0.2%

Medium (5.4). EPSS 0.2% chance of exploitation in the next 30 days.

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-616
Published: 2025-08-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/SMEWebify/WebErpMesv2
https://medium.com/@The_Hiker/wrong-variable-name-leads-to-rce-cve-2025-52130-8ff59a7d245c

Check your stack JSON