CVE-2025-3558

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-3558

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3558.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-3558

Published

2025-04-14T08:31:06Z

Modified

2026-10-24T10:50:23Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

ghostxbh uzy-ssm-mall uploadUserHeadImage unrestricted upload

Details

A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-284",
        "CWE-434"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3558.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "1.0.0"
                        },
                        {
                            "last_affected":  "1.0.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/ghostxbh/uzy-ssm-mall

Affected ranges

Type

GIT

Repo

https://github.com/ghostxbh/uzy-ssm-mall

Events

Introduced

a93d48f7eb212e219679a046f4bd484c43420e24

Last Affected

a93d48f7eb212e219679a046f4bd484c43420e24

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:ghostxbh:uzy-ssm-mall:1.0.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "last_affected":  "1.0.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*

1.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3558.json"