CVE-2025-15130

shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection

State: Published
Severity: 5.1 Medium
Published: Dec 28, 2025
Updated: Dec 29, 2025
Reserved: Dec 27, 2025

Description

A vulnerability has been found in shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921. This issue affects the function addPost of the file Application/Admin/Controller/FileManageController.class.php of the component Administrative Panel. The manipulation leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	4.7 Medium	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	5.8 Medium	AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-94 Code Injection
CWE-74 Injection

Affected Products

Product	Versions
SyCmsshanyu	a242ef2d194e8bb249dc175e7c49f2c1673ec921Affected

References

VDB-338508 | shanyu SyCms Administrative Panel FileManageController.class.php addPost code injectionvdb-entrytechnical-description
VDB-338508 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #712813 | SyCms 1.0 Unrestricted Uploadthird-party-advisory
https://gitee.com/shanyu/SyCms/issues/IDCEWGexploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.