CVE-2025-5380

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 up to 4d3f0ada0e71482c1e51fd5f5615e5a3d8bcbfbb. This issue affects some unknown processing of the file /upload/ of the component Image File Upload. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 31, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-538007.8No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2025-538017.8Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally.CVE-2025-538027.0Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.CVE-2025-538035.5Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locallyCVE-2025-538045.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-538057.5Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.CVE-2025-538066.5Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-538077.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorCVE-2025-538086.7Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate CVE-2025-538096.5Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over aCVE-2025-53817.2A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the fileCVE-2025-538106.7Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate
CVE-2025-5380: Medium severity, CVSS 6.3 | Vulnix