CVE-2025-7939mediumCWE-284CWE-434

CVE-2025-7939: medium-severity vulnerability in jerryshensjf JPACookieShop 蛋糕商城JPA版

jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java addGoods unrestricted upload

Published · Updated

Follow this CVE+ Monitor JPACookieShop 蛋糕商城JPA版

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsController.java. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
jerryshensjf · JPACookieShop 蛋糕商城JPA版
Related CVEs — jerryshensjf JPACookieShop 蛋糕商城JPA版

In the same product, most dangerous first.

CVE-2025-8221MEDIUMjerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scriptingEPSS 0.6%CVE-2025-7938MEDIUMjerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorizationEPSS 0.4%CVE-2025-8222MEDIUMjerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scriptingEPSS 0.4%CVE-2025-8223MEDIUMjerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgeryEPSS 0.3%