CVE-2025-15499: high-severity vulnerability in Sangfor Operation and Maintenance Management…
Sangfor Operation and Maintenance Management System VersionController.java uploadCN os command injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 5.7%
A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function uploadCN of the file VersionController.java. The manipulation of the argument filename leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
Sangfor · Operation and Maintenance Management SystemRelated CVEs — Sangfor Operation and Maintenance Management…
In the same product, most dangerous first.
CVE-2026-1324HIGHSangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injectionEPSS 7.0%CVE-2025-15501CRITICALSangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injectionEPSS 6.9%CVE-2025-15500CRITICALSangfor Operation and Maintenance Management System HTTP POST Request getHis os command injectionEPSS 6.1%CVE-2025-15502MEDIUMSangfor Operation and Maintenance Management System session SessionController os command injectionEPSS 6.1%CVE-2025-15503MEDIUMSangfor Operation and Maintenance Management System common.jsp unrestricted uploadEPSS 2.0%