Vulnerability · Published Jun 11, 2025 · Assigned by BLSOPS

CVE-2025-6002VirtueMart - Unrestricted File Upload

High 7.2

In plain English

A high-severity unrestricted file upload in VirtueMart from VirtueMart. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.8%top 42.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution or other security impacts depending on server configuration.

Affected products (as reported)

Vendor	Product	Versions
VirtueMart	VirtueMart	3.0.0 – before 4.4.10

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://blog.blacklanternsecurity.com/p/doomla-zero-days