Vulnerability · Published Oct 20, 2025 · Assigned by ZUSO ART
CVE-2025-31342Galaxy Software Services Vitals ESP Forum Module - Unrestricted Upload of File with Dangerous Type
Critical 9.3
In plain English
A critical-severity unrestricted file upload in Vitals ESP from Galaxy Software Services Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.5%top 57.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Galaxy Software Services Corporation | Vitals ESP | 0 – through 1.3 |
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
References
- https://zuso.ai/advisory/za-2025-15 third-party-advisory