CVE-2025-9406

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

• CWE-284
• CWE-434
• CWE-434

• https://github.com/xuhuisheng/lemon/issues/212Exploit, Issue Tracking
• https://github.com/xuhuisheng/lemon/issues/212#issue-3317490086Exploit, Issue Tracking
• https://vuldb.com/?ctiid.321242Permissions Required, VDB Entry
• https://vuldb.com/?id.321242Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.633593Third Party Advisory, VDB Entry
• https://github.com/xuhuisheng/lemon/issues/212Exploit, Issue Tracking
• https://github.com/xuhuisheng/lemon/issues/212#issue-3317490086Exploit, Issue Tracking
• https://vuldb.com/?submit.633593Third Party Advisory, VDB Entry

Published

Aug 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9400A flaw has been found in YiFang CMS up to 2.0.5. This affect…8.8
• CVE-2025-9401A vulnerability has been found in HuangDou UTCMS 9. This vul…3.7
• CVE-2025-9402A vulnerability was found in HuangDou UTCMS 9. This issue af…7.2
• CVE-2025-9403A vulnerability was determined in jqlang jq up to 1.6. Impac…5.5
• CVE-2025-9404A vulnerability was identified in Scada-LTS up to 2.7.8.1. T…5.4
• CVE-2025-9405A security flaw has been discovered in Open5GS up to 2.7.5. …5.5
• CVE-2025-9407A flaw has been found in mtons mblog up to 3.5.0. Affected b…5.4
• CVE-2025-9408System call entry on Cortex M (and possibly R and A, but I t…8.1
• CVE-2025-9409A security flaw has been discovered in lostvip-com ruoyi-go …6.5
• CVE-2025-9410A weakness has been identified in lostvip-com ruoyi-go up to…9.8
• CVE-2025-9411A security vulnerability has been detected in lostvip-com ru…9.8
• CVE-2025-9412A vulnerability was detected in lostvip-com ruoyi-go up to 2…9.8