CVE-2025-15360

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
n/a	newbee-mall-plus	2.0.0

References

https://github.com/zyhzheng500-maker/cve/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.338744Permissions Required, VDB Entry
https://vuldb.com/?id.338744Third Party Advisory, VDB Entry
https://vuldb.com/?submit.716785Third Party Advisory, VDB Entry
https://github.com/zyhzheng500-maker/cve/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.mdExploit, Third Party Advisory

Timeline

Published: Dec 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-153635.9The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perfor CVE-2025-153647.3The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3 CVE-2025-153665.9The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands CVE-2025-153675.9The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands CVE-2025-153688.8The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'temp CVE-2025-153695.3The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi CVE-2025-15376.3A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /di CVE-2025-153704.3The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Referen CVE-2025-153717.8A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknow CVE-2025-153724.8A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/view CVE-2025-153734.3A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php.CVE-2025-153745.4A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php