CVE-2025-4258

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master\src\main\java\com\ukefu\webim\web\handler\resource\MediaController.java. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 5, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-42599.8A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the fCVE-2025-425987.8Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a lCVE-2025-425999.8Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted requCVE-2025-42608.3A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsavCVE-2025-426008.2This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts throCVE-2025-426018.2This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remoteCVE-2025-426028.2This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authenticaCVE-2025-426038.7This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certCVE-2025-426046.9This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this CVE-2025-426059.3This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modiCVE-2025-42615.3A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affecCVE-2025-426116.5RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integri