CVE-2025-31342

critical · 9.3

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file.

9.3

CVSS

0.5%

EPSS (exploit prob.)

39th

EPSS percentile

2025-10-20

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

References

https://zuso.ai/advisory/za-2025-15

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-31342