CVE-2025-40599

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-40609.8A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown pro CVE-2025-406009.8Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause CVE-2025-406017.5A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Servic CVE-2025-406026.6A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).CVE-2025-406034.5A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administr CVE-2025-406049.8Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verify CVE-2025-406055.3A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by inj CVE-2025-40617.8A vulnerability, which was classified as critical, was found in code-projects Clothing Store Management System up to 1.0. Affected is the fu CVE-2025-406156.1Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim CVE-2025-406166.1Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim CVE-2025-406179.8SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sendin CVE-2025-406189.8SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sendin