CVE-2025-2702

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Softwin WMX3 3.1. This issue affects the function ImageAdd of the file /ImageAdd.ashx. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-270209.8Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data CVE-2025-270217.8The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to CVE-2025-270226.5A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all CVE-2025-270236.5Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS file CVE-2025-270246.5Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS fil CVE-2025-270258.8The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic CVE-2025-270264.9A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to m CVE-2025-270274.1A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of al CVE-2025-270286.8The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, includin CVE-2025-270297.5Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.CVE-2025-27036.8The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in or CVE-2025-270306.1information disclosure while invoking calibration data from user space to update firmware size.