CVE-2025-2490

Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting

A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java of the component File Upload. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

Dromara · ujcms

CVSS v4.0 VULDB

4.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 VULDB

2.4 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0 VULDB

3.3 LOWAV:N/AC:L/Au:M/C:N/I:P/A:N

EPSS

0.33% chance of exploitation in the next 30 days, 24th percentile

Published

2025-03-18

Proof-of-concept exploits (1)

• dromara/ujcms/issues/13667★ · 2026-09-21

Security advisories

• dromara/ujcms/issues/12
• https://vuldb.com/?id.299996
• https://vuldb.com/?submit.517267

References

• CVE Record
• NVD entry

Related

• CVE-2023-42278
• CVE-2023-51075
• CVE-2025-13268
• CVE-2025-2491
• CVE-2026-19756
• CVE-2026-19757