CVE-2025-13949

MediumCVSS 6.3/10Last modified Oct 18, 2026

Description

A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileController.go. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Dec 3, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-13958.2Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson a CVE-2025-139505.3The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c CVE-2025-139529.8A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free c CVE-2025-139539.3Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) logi CVE-2025-139549.3Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and ga CVE-2025-139559.3Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II before version 1.17478.177 allows attackers in Wi-Fi range CVE-2025-139565.3The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on CVE-2025-139577.5CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Pro CVE-2025-139585.9The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputti CVE-2025-139596.4The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up t CVE-2025-13965.3A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the syst CVE-2025-139606.4The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to,