CVE-2025-2706

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
Digiwin	ERP	5.0.1

References

Timeline

Published: Mar 24, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-270608.8Memory corruption while performing SCM call with malformed inputs.CVE-2025-270617.8Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.CVE-2025-270627.8Memory corruption while handling client exceptions, allowing unauthorized channel access.CVE-2025-270637.8Memory corruption during video playback when video session open fails with time out error.CVE-2025-270646.1Information disclosure while registering commands from clients with diag through diagHal.CVE-2025-270657.5Transient DOS while processing a frame with malformed shared-key descriptor.CVE-2025-270667.5Transient DOS while processing an ANQP message.CVE-2025-270677.8Memory corruption while processing DDI call with invalid buffer.CVE-2025-270687.8Memory corruption while processing an IOCTL command with an arbitrary address.CVE-2025-270697.8Memory corruption while processing DDI command calls.CVE-2025-27079.1A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unkno CVE-2025-270707.8Memory corruption while performing encryption and decryption commands.