CVE-2025-30510

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An attacker can upload an arbitrary file instead of a plant image.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-351

Affected software

VendorProductVersions
GrowattCloud portal< 3.6.0

References

Timeline

Published
Apr 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-305115.4An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plantCVE-2025-305126.5Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-305137.9Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privilegCVE-2025-305145.3Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").CVE-2025-305158.8CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.CVE-2025-305167.5Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowiCVE-2025-305186.7Incorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow an escalation of CVE-2025-305199.8Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative mCVE-2025-30528.2An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker CVE-2025-305207.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms breezing-formsCVE-2025-305214.3Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top gp-back-to-top allows Cross Site Request Forgery.This issue affeCVE-2025-305227.1Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This is
CVE-2025-30510: Critical severity, CVSS 9.8 | Vulnix