CVE-2025-57794

critical · 9.1

Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict uploaded file types, allowing malicious files to be uploaded and executed by the server. This condition enables remote code execution under default configurations.

9.1

CVSS

0.6%

EPSS (exploit prob.)

46th

EPSS percentile

2026-01-28

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
explorance	blue	< 8.14.9

Check a specific version with /api/v1/cve/match.

References

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0003.md
https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)
https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57794
https://www.explorance.com/products/blue

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-57794