CVE-2025-15415
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An unrestricted upload vulnerability was found in wangmarket up to 6.4, in the uploadImage function of the file /sits/uploadImage.do. Manipulating the image argument allows remote exploitation.
Risk Assessment
An attacker can upload malicious files to the server, potentially leading to code execution or server compromise.
Recommendation
Update wangmarket to a version newer than 6.4 if available, or restrict access to the uploadImage function and validate uploaded files.
Other vulnerabilities in wangmarket
See all- CVE-2025-15452Low
A vulnerability in xnx3 wangmarket up to 4.9, affecting the function variableList in the file /admin/system/variableList.do of the Backend Variable Search component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be launched remotely. The exploit has been made public.
- CVE-2025-15451Low
A vulnerability in xnx3 wangmarket up to 4.9, affecting an unknown function in the file /admin/system/variableSave.do of the System Variables Page component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been released publicly.
- CVE-2025-15416Low
A cross-site scripting (XSS) vulnerability exists in xnx3 wangmarket up to 6.4 in an unknown function of /siteVar/save.do (Add Global Variable Handler component). Manipulation of the Remark/Variable Value argument leads to XSS. The attack can be executed remotely and the exploit is public.
Original NVD description (English source)
A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component XML File Handler. The manipulation of the argument image leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS