CVE-2025-15090

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This vulnerability affects the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	进取 512W	1.7.7-171114

References

https://github.com/cymiao1978/cve/blob/main/new/15.mdExploit, Third Party Advisory
https://github.com/cymiao1978/cve/blob/main/new/15.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.338419Permissions Required, VDB Entry
https://vuldb.com/?id.338419Third Party Advisory, VDB Entry
https://vuldb.com/?submit.708349Third Party Advisory, VDB Entry

Timeline

Published: Dec 25, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-150919.8A vulnerability was determined in UTT 进取 512W up to 1.7.7-171114. This issue affects the function strcpy of the file /goform/formPictureUrl.CVE-2025-150929.8A vulnerability was identified in UTT 进取 512W up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/ConfigExceptMSN. Such CVE-2025-150936.1A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown f CVE-2025-150946.1A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function user CVE-2025-150953.5A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/h CVE-2025-150968.8The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and CVE-2025-150977.3A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performi CVE-2025-150986.3A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigg CVE-2025-150999.8A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/intern CVE-2025-15109.8The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ CVE-2025-151008.8The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is du CVE-2025-151018.8An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrato