What’s Vulnerable › Vulnerabilities

CVE-2025-15152: h-moses moga-mall PmsProductController.java addProduct unrestricted upload

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-28 · updated 2026-10-07
• Weakness: CWE-284

Description

A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the file src/main/java/com/ms/product/controller/PmsProductController.java. Such manipulation of the argument objectName leads to unrestricted upload. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.

Affected products

• h-moses moga-mall: 392d631a5ef15962a9bddeeb9f1269b9085473fa

References

• https://github.com/zyhzheng500-maker/cve/blob/main/moga-mall%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
• https://vuldb.com/?ctiid.338529
• https://vuldb.com/?id.338529
• https://vuldb.com/?submit.721988

Get alerted when CVE-2025-15152 or the next vulnerability affects your stack