CVE-2025-1028highCWE-434

CVE-2025-1028: falha de alta gravidade em kleor Contact Manager

Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Contact Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.8%
The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in specific configurations where the first extension is processed over the final. This vulnerability also requires successfully exploiting a race condition in order to exploit.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
kleor · Contact Manager
CVEs relacionadas — kleor Contact Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2026-109218CRITICALContact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist BypassEPSS 0.6%CVE-2025-8783MEDIUMContact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'EPSS 0.3%