CVE-2025-48782

critical · 9.9

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a malicious file.

9.9

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2025-06-06

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
scshr	hr_portal	<= 7.3.2025.0408

Check a specific version with /api/v1/cve/match.

References

https://zuso.ai/advisory/za-2025-07

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-48782