CVE-2025-4768: medium-severity vulnerability in feng_ha_ha ssm-erp
feng_ha_ha/megagao ssm-erp/production_ssm PictureServiceImpl.java uploadPicture unrestricted upload
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file PictureServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
feng_ha_ha · production_ssmfeng_ha_ha · ssm-erpmegagao · production_ssmmegagao · ssm-erpRelated CVEs — feng_ha_ha ssm-erp
In the same product, most dangerous first.
CVE-2025-4530MEDIUMfeng_ha_ha/megagao ssm-erp/production_ssm File FileController.java handleFileDownload path traversalEPSS 0.5%CVE-2026-2863MEDIUMfeng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java deleteFile path traversalEPSS 0.4%CVE-2026-2864MEDIUMfeng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversalEPSS 0.4%CVE-2025-4333MEDIUMfeng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java uploadFile unrestricted uploadEPSS 0.3%CVE-2026-2860MEDIUMfeng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorizationEPSS 0.3%