Vulnerability · Published Dec 30, 2025 · Assigned by VulDB
CVE-2025-15360newbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload
Medium 4.7
In plain English
A medium-severity unrestricted file upload in newbee-mall-plus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | newbee-mall-plus | 2.0.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-338744 | newbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload vdb-entry, technical-description
- VDB-338744 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #716785 | https://github.com/newbee-ltd/newbee-mall-plus newbee-mall-plus 2.0.0 Upload any file third-party-advisory
- https://github.com/zyhzheng500-maker/cve/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md exploit