CVE-2025-10398
fcba_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted upload
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 14, 2025
- Updated
- Sep 15, 2025
- Reserved
- Sep 13, 2025
Description
A security flaw has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils.java. The manipulation of the argument File results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ics-park Smart Park Management Systemfcba_zzm |
|
References
- VDB-323833 | fcba_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted uploadvdb-entrytechnical-description
- VDB-323833 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #646303 | fcba_zzm ics-park 2.0 Unrestricted Uploadthird-party-advisory
- https://github.com/Yyjccc/CVE/issues/2exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.