CVE-2025-1833: falha de média gravidade em zj1983 zz
zj1983 zz HTTP Request Customer_noticeAction.java sendNotice server-side request forgery
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/main/java/com/futvan/z/erp/customer_notice/Customer_noticeAction.java of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
zj1983 · zzCVEs relacionadas — zj1983 zz
No mesmo produto, das mais perigosas para as menos.
CVE-2025-1818MEDIUMzj1983 zz ZfileAction.upload unrestricted uploadEPSS 0.7%CVE-2025-1846MEDIUMzj1983 zz File ZfileAction.java deleteLocalFile denial of serviceEPSS 0.6%CVE-2025-1812MEDIUMzj1983 zz SuperZ.java GetUserOrg sql injectionEPSS 0.6%CVE-2025-1831MEDIUMzj1983 zz ZorgAction.java GetDBUser sql injectionEPSS 0.6%CVE-2025-1821MEDIUMzj1983 zz ZorgAction.java getUserOrgForUserId sql injectionEPSS 0.6%CVE-2025-1834MEDIUMzj1983 zz resolve unrestricted uploadEPSS 0.6%