CVE-2025-52130

State: Published
Severity: 5.4 Medium
Published: Aug 25, 2025
Updated: Aug 26, 2025
Reserved: Jun 16, 2025

Description

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	CISA-ADP

Weaknesses

CWE-616 Incomplete Identification of Uploaded File Variables (PHP)

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/SMEWebify/WebErpMesv2
https://medium.com/@The_Hiker/wrong-variable-name-leads-to-rce-cve-2025-52130-8ff59a7d245c

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.