CVE-2025-55744mediumCWE-352

CVE-2025-55744: medium-severity vulnerability in unopim

UnoPim vulnerable to CSRF on Product edit feature and creation of other types

Published

Follow this CVE+ Monitor unopim+ Monitor unopim/unopim

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.2%
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). This vulnerability is fixed in 0.2.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
unopim · unopim
Related CVEs — unopim

In the same product, most dangerous first.

CVE-2025-55745LOWUnoPim Quick Export feature is vulnerable to CSV injectionEPSS 0.6%CVE-2026-82524HIGHUnoPim File Upload RCE via TinyMCE Image Upload EndpointEPSS 0.6%CVE-2025-55743HIGHUnoPim vulnerable to remote code execution through Arbitrary File uploadEPSS 0.5%CVE-2025-55741HIGHunopim/unopim allows unauthorized product deletion via mass-delete endpointEPSS 0.4%CVE-2026-85395HIGHUnoPim before 2.1.3 Missing Authorization on Integration Management RoutesEPSS 0.4%CVE-2025-55742HIGHUnoPim Stored XSS via SVG MIME/Sanitizer BypassEPSS 0.4%