CVE-2025-10353
CriticalCVSS 9.3Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
Risk Assessment
An attacker can upload and execute malicious code on the server, leading to full compromise of the application and data.
Recommendation
Update Melis Platform to the latest version and implement file type validation and execution restrictions in the upload directory.
Other vulnerabilities in Melis Platform
See all- CVE-2025-10352Critical
A vulnerability in the melis-core module of Melis Technology's Melis Platform allows an unauthenticated attacker to create an administrator account. Exploitation occurs via a request to the '/melis/MelisCore/ToolUser/addNewUser' endpoint.
- CVE-2025-10351Critical
A SQL injection vulnerability in the melis-cms module of the Melis platform from Melis Technology allows an attacker to retrieve, create, update, and delete databases. The vulnerability occurs in the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
Original NVD description (English source)
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS