CVE-2025-31342criticalCWE-434

CVE-2025-31342: critical vulnerability in Galaxy Software Services Corporation Vitals ESP

Galaxy Software Services Vitals ESP Forum Module - Unrestricted Upload of File with Dangerous Type

Published · Updated

Follow this CVE+ Monitor Vitals ESP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.5%
An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
Affected products
Galaxy Software Services Corporation · Vitals ESP