CVE-2025-4260

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web\handler\admin\system\TemplateController.java. The manipulation of the argument dataFile leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

Vendor	Product	Versions
zhangyanbo2007	youkefu	4.0; 4.1; 4.2.0

References

https://github.com/Serein123y/vulnerability/blob/main/vul.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.307364Permissions Required, VDB Entry
https://vuldb.com/?id.307364Third Party Advisory, VDB Entry
https://vuldb.com/?submit.562902Third Party Advisory, VDB Entry

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-426008.2This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts thro CVE-2025-426018.2This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote CVE-2025-426028.2This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentica CVE-2025-426038.7This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of cert CVE-2025-426046.9This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this CVE-2025-426059.3This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modi CVE-2025-42615.3A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affec CVE-2025-426116.5RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integri CVE-2025-426158.1In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication CVE-2025-426167.0Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or othe CVE-2025-42629.8A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been declared as critical. This vulnerability affect CVE-2025-426208.3In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to s