CVE-2025-2490

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java of the component File Upload. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
Dromara	ujcms	9.7.5

References

https://github.com/dromara/ujcms/issues/12Exploit, Issue Tracking, Vendor Advisory
https://github.com/dromara/ujcms/issues/13Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.299996Permissions Required, VDB Entry
https://vuldb.com/?id.299996Third Party Advisory, VDB Entry
https://vuldb.com/?submit.517267Third Party Advisory, VDB Entry

Timeline

Published: Mar 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-249008.6Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and impr CVE-2025-249018.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissa CVE-2025-249028.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php CVE-2025-249038.5libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Sig CVE-2025-249048.5libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Sig CVE-2025-249059.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras CVE-2025-249069.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cob CVE-2025-249076.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not prop CVE-2025-249086.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not prop CVE-2025-249094.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is u CVE-2025-24915.4A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com CVE-2025-249104.9Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of