CVE-2025-55743highCWE-434

CVE-2025-55743: high-severity vulnerability in unopim

UnoPim vulnerable to remote code execution through Arbitrary File upload

Published

Follow this CVE+ Monitor unopim+ Monitor unopim/unopim

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.5%
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The vulnerability is fixed in 0.2.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
unopim · unopim
Related CVEs — unopim

In the same product, most dangerous first.

CVE-2025-55745LOWUnoPim Quick Export feature is vulnerable to CSV injectionEPSS 0.6%CVE-2026-82524HIGHUnoPim File Upload RCE via TinyMCE Image Upload EndpointEPSS 0.6%CVE-2025-55741HIGHunopim/unopim allows unauthorized product deletion via mass-delete endpointEPSS 0.4%CVE-2026-85395HIGHUnoPim before 2.1.3 Missing Authorization on Integration Management RoutesEPSS 0.4%CVE-2025-55742HIGHUnoPim Stored XSS via SVG MIME/Sanitizer BypassEPSS 0.4%CVE-2024-52305MEDIUMUnoPim Stored XSS : Cookie hijacking through Create User functionEPSS 0.2%