CVE-2025-8775
A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical.
Does this matter?
Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of the file /api/code/upload of the component Scheduled Task Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.42% probability · 35th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-434
- Affected
- qiyuesuo/electronic signature
- Source
- cna@vuldb.com
References
- https://github.com/nn0nkey/nn0nkey/blob/main/QYS/QYS_task.mdExploit
- https://vuldb.com/?ctiid.319298Permissions Required, VDB Entry
- https://vuldb.com/?id.319298Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.625551Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.625553Third Party Advisory, VDB Entry
- https://github.com/nn0nkey/nn0nkey/blob/main/QYS/QYS_task.mdExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.