Vulnerability · Published Sep 14, 2025 · Assigned by VulDB

CVE-2025-10398fcba_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted upload

Medium 6.3

In plain English

A medium-severity unrestricted file upload in ics-park Smart Park Management System from fcba_zzm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils.java. The manipulation of the argument File results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be exploited.

Affected products (as reported)

Vendor	Product	Versions
fcba_zzm	ics-park Smart Park Management System	2.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-323833 | fcba_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted upload vdb-entry, technical-description
VDB-323833 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #646303 | fcba_zzm ics-park 2.0 Unrestricted Upload third-party-advisory
https://github.com/Yyjccc/CVE/issues/2 exploit, issue-tracking