CVE-2025-2855

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotely.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

Vendor	Product	Versions
elunez	eladmin	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7

References

https://github.com/elunez/eladmin/issues/873Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.301502Permissions Required, VDB Entry
https://vuldb.com/?id.301502Third Party Advisory, VDB Entry
https://vuldb.com/?submit.522504Third Party Advisory, VDB Entry

Timeline

Published: Mar 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-285710.0Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compr CVE-2025-28588.8Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use CVE-2025-28599.8An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and m CVE-2025-28605.3SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have withi CVE-2025-28617.5SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that informat CVE-2025-28627.5SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or CVE-2025-28637.8Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenti CVE-2025-28646.1SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device,CVE-2025-28656.1SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker CVE-2025-28665.5Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In t CVE-2025-28676.5An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 b CVE-2025-28686.1Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker t