CVE-2025-2490

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-2490

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2490.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-2490

Published

2025-03-18T14:00:07.337Z

Modified

2026-07-15T01:49:19.153300494Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting

Details

A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java of the component File Upload. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Database specific

{
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2490.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/dromara/ujcms

Affected ranges

Type

GIT

Repo

https://github.com/dromara/ujcms

Events

Introduced

ab2b382aeace6ba0dd6a271f6c5e3964dcee1c86

Last affected

ab2b382aeace6ba0dd6a271f6c5e3964dcee1c86

Database specific

{
    "cpe": "cpe:2.3:a:ujcms:ujcms:9.7.5:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.7.5"
        },
        {
            "last_affected": "9.7.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

9.*

9.7.5

v9.*

v9.7.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2490.json"