CVE-2025-11948criticalCWE-434

CVE-2025-11948: critical vulnerability in Excellent Infotek Document Management System

Excellent Infotek｜Document Management System - Arbitrary File Upload

Published 20 Oct 2025 · Updated 12 Nov 2025

Follow this CVE + Monitor Document Management System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 1.0%

Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Excellent Infotek · Document Management System

References

https://www.chtsecurity.com/news/3575ad9c-31f4-49de-8bc4-de85bb2eed39 https://www.twcert.org.tw/en/cp-139-10453-43e63-2.html https://www.twcert.org.tw/tw/cp-132-10452-72cb6-1.html