CVE-2025-8852

MediumCVSS 4.3/10Last modified Jul 14, 2026

Description

A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-209

Affected software

Vendor	Product	Versions
WuKongOpenSource	WukongCRM	11.0

References

https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26Exploit, Issue Tracking, Vendor Advisory
https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26#issue-3272864284Exploit, Issue Tracking
https://vuldb.com/?ctiid.319383Permissions Required, VDB Entry
https://vuldb.com/?id.319383Third Party Advisory, VDB Entry
https://vuldb.com/?submit.624693Third Party Advisory, VDB Entry
https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Aug 11, 2025
Last modified: Jul 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-88539.8Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote CVE-2025-88549.8Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary co CVE-2025-88558.1Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-CVE-2025-88579.8Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system CVE-2025-88587.5Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary S CVE-2025-88598.8A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /nati CVE-2025-88603.3A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `CVE-2025-88619.8TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete CVE-2025-88627.0YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigat CVE-2025-88637.0YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission CVE-2025-88646.8Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs CVE-2025-88654.1The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain