CVE-2025-1890

A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• CWE-284
• CWE-434
• CWE-434

• https://github.com/caigo8/CVE-md/blob/main/shishuocms/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.mdExploit
• https://vuldb.com/?ctiid.298408Permissions Required
• https://vuldb.com/?id.298408Third Party Advisory
• https://vuldb.com/?submit.505736Third Party Advisory

Published

Mar 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1884Use-After-Free vulnerability exists in the SLDPRT file readi…7.8
• CVE-2025-1885URL Redirection to Untrusted Site ('Open Redirect') vulnerab…5.4
• CVE-2025-1886Pass-Back vulnerability in versions prior to 2025.35.000 of …7.1
• CVE-2025-1887SMB forced authentication vulnerability in versions prior to…7.1
• CVE-2025-1888The Leica Web Viewer within the Aperio Eslide Manager Applic…4.6
• CVE-2025-1889picklescan before 0.0.22 only considers standard pickle file…9.8
• CVE-2025-1891A vulnerability was found in shishuocms 1.1 and classified a…5.3
• CVE-2025-1892A vulnerability was found in shishuocms 1.1. It has been cla…4.8
• CVE-2025-1893A vulnerability was found in Open5GS up to 2.7.2. It has bee…7.5
• CVE-2025-1894A vulnerability was found in PHPGurukul Restaurant Table Boo…9.8
• CVE-2025-1895A vulnerability classified as critical has been found in Ten…7.5
• CVE-2025-1896A vulnerability classified as critical was found in Tenda TX…7.5