CVE-2025-15228

CriticalCVSS 9.8

Published: 29/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

47th percentile - higher than 47% of all known CVEs

Summary

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Risk Assessment

An unauthenticated attacker can take control of the server by executing malicious code, potentially leading to breaches of confidentiality, integrity, and availability.

Recommendation

Update BPMFlowWebkit to the latest version or implement protections such as file upload validation and restrict access to upload functionality.

Other vulnerabilities in BPMFlowWebkit

CVE-2025-15227High
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.

Original NVD description (English source)

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS