CVE-2025-6002 | THREATINT

Description

An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution or other security impacts depending on server configuration.

Reserved 2025-06-11 | Published 2025-06-11 | Updated 2025-06-11 | Assigner BLSOPS

HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status

unaffected

3.0.0 before 4.4.10

affected

References

blog.blacklanternsecurity.com/p/doomla-zero-days

cve.org (CVE-2025-6002)

nvd.nist.gov (CVE-2025-6002)

Download JSON