CVE-2025-2705

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-270507.8Memory corruption while processing event close when client process terminates abruptly.CVE-2025-270517.8Memory corruption while processing command message in WLAN Host.CVE-2025-270527.8Memory corruption while processing data packets in diag received from Unix clients.CVE-2025-270537.8Memory corruption during PlayReady APP usecase while processing TA commands.CVE-2025-270547.8Memory corruption while processing a malformed license file during reboot.CVE-2025-270557.8Memory corruption during the image encoding process.CVE-2025-270567.8Memory corruption during sub-system restart while processing clean-up to free up resources.CVE-2025-270577.5Transient DOS while handling beacon frames with invalid IE header length.CVE-2025-270587.8Memory corruption while processing packet data with exceedingly large packet.CVE-2025-270598.8Memory corruption while performing SCM call.CVE-2025-27066.3A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the filCVE-2025-270608.8Memory corruption while performing SCM call with malformed inputs.
CVE-2025-2705: High severity, CVSS 7.3 | Vulnix