CVE-2025-1947mediumCWE-74CWE-77

CVE-2025-1947: medium-severity vulnerability in hzmanyun Education and Training System

hzmanyun Education and Training System UploadImageController.java scorm command injection

Published

Follow this CVE+ Monitor Education and Training System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 5.2%
A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of the file UploadImageController.java. The manipulation of the argument param leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
hzmanyun · Education and Training System
Related CVEs — hzmanyun Education and Training System

In the same product, most dangerous first.

CVE-2025-1946MEDIUMhzmanyun Education and Training System exportPDF command injectionEPSS 5.2%CVE-2025-1676MEDIUMhzmanyun Education and Training System pdf2swf os command injectionEPSS 2.4%CVE-2025-1555MEDIUMhzmanyun Education and Training System saveImage unrestricted uploadEPSS 0.7%