CVE-2025-12867: high-severity vulnerability in Hundred Plus EIP Plus
Hundred Plus｜EIP Plus - Arbitrary File Uplaod
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.7%
EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Hundred Plus · EIP PlusRelated CVEs — Hundred Plus EIP Plus
In the same product, most dangerous first.