CVE Catalog
CVE-2025-63695
CriticalSummary
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
Risk Assessment
Risk of remote code execution and full application compromise by an attacker.
Recommendation
Update to a patched version and implement file upload validation.
Other vulnerabilities in DzzOffice
See all- CVE-2025-63694Critical
DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
- CVE-2022-43340High
A Cross-Site Request Forgery (CSRF) vulnerability in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.
Original NVD description (English source)
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.