CVE-2025-8852
Last modified
CVE-2025-8852 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| 5kcrm | Wukong Crm | 11.0 |
References
- https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26Exploit, Issue Tracking, Vendor Advisory
- https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26#issue-3272864284Exploit, Issue Tracking
- https://vuldb.com/?ctiid.319383Permissions Required, VDB Entry
- https://vuldb.com/?id.319383Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.624693Third Party Advisory, VDB Entry
- https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26Exploit, Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-8852?
How severe is CVE-2025-8852?
How do I fix CVE-2025-8852?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-8846A vulnerability has been found in NASM Netwide Assember 2.17…7.8
- CVE-2025-8847A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1…5.4
- CVE-2025-8848A vulnerability in danny-avila/librechat version 0.7.9 allow…5.4
- CVE-2025-8849LibreChat version 0.7.9 is vulnerable to a Denial of Service…7.5
- CVE-2025-8850In danny-avila/librechat version 0.7.9, there is an insecure…8.8
- CVE-2025-8851A vulnerability was determined in LibTIFF up to 4.5.1. Affec…5.3
- CVE-2025-8853Official Document Management System developed by 2100 Techno…9.8
- CVE-2025-8854Stack-based buffer overflow in LoadOFF in bulletphysics bull…9.8
- CVE-2025-8855Authorization Bypass Through User-Controlled Key, Weak Passw…8.1
- CVE-2025-8857Clinic Image System developed by Changing contains hard-code…9.8
- CVE-2025-8858Clinic Image System developed by Changing has a SQL Injectio…8.7
- CVE-2025-8859A vulnerability was identified in code-projects eBlog Site 1…8.8
Are you affected by CVE-2025-8852?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST