CVE-2025-6002

VirtueMart - Unrestricted File Upload

CVSS 7.2 HIGHEPSS 0.7%CWE-434

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.2EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 jun 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution or other security impacts depending on server configuration.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Productos afectados

VirtueMart · VirtueMart

Referencias

https://blog.blacklanternsecurity.com/p/doomla-zero-days