What’s Vulnerable › Vulnerabilities

CVE-2025-31340: Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP Program

• Severity: critical (CVSS 9.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-17 · updated 2026-06-17
• Weakness: CWE-98

Description

A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.

Affected products

• SUNNET Technology Co., Ltd. Wisdom Master Pro: from 5.0 through 5.2

References

• https://zuso.ai/advisory/za-2025-03

Get alerted when CVE-2025-31340 or the next vulnerability affects your stack