Is there a public PoC exploit available for CVE-2025-15360?

Yes, a public proof-of-concept exploit is available for CVE-2025-15360. Prioritise patching immediately. EPSS: 0.1%.

newbee-mall-plus CVE-2025-15360

Q: What is the CVSS score of CVE-2025-15360?

CVE-2025-15360 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-12-30 cna@vuldb.com

Authentication Bypass Java File Upload Newbee Mall Plus

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.0 MEDIUM

PR:H reflects admin-only upload access; I:H for arbitrary file write to the server; S:U and limited C/A pending confirmation that uploads land in an executable web-accessible path.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:36 vuln.today

CVE Published

Dec 30, 2025 - 22:15 cve.org

LOW 2.0

DescriptionCVE.org

A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload in newbee-mall-plus 2.0.0 permits authenticated high-privilege users to submit arbitrary files through the Product Information Edit Page, bypassing server-side file type validation in UploadController.java. The affected CPE is cpe:2.3:a:newbee-ltd:newbee-mall-plus:2.0.0:*:*:*:*:*:*:*, and a public proof-of-concept has been disclosed via GitHub. No patch is available at time of analysis, as the vendor did not respond to responsible disclosure; however, EPSS at 0.05% (17th percentile) and the PR:H CVSS requirement together indicate low observed exploitation probability despite POC existence.

Technical ContextAI

newbee-mall-plus is a Java-based open-source e-commerce platform (CPE: cpe:2.3:a:newbee-ltd:newbee-mall-plus:2.0.0:*:*:*:*:*:*:*). The vulnerable code resides in src/main/java/ltd/newbee/mall/controller/common/UploadController.java, specifically the Upload function invoked from the Product Information Edit Page. The root cause is CWE-284 (Improper Access Control), manifesting as the absence of server-side MIME type or file extension enforcement on uploaded content. In a Java web application context, successful upload of a .jsp or .jspx webshell to an accessible directory typically results in remote code execution via the application server's servlet engine. The 'Authentication Bypass' tag in CVE metadata hints that a separate access-control flaw may reduce the effective privilege barrier below PR:H, though this is not confirmed in the CVE description.

RemediationAI

No vendor-released patch has been identified at time of analysis. As compensating controls, administrators should restrict network access to the Product Information Edit Page and its upload endpoint to trusted internal IPs or VPN-only segments, reducing the effective attack surface from AV:N to AV:L - note this may impact legitimate admin workflows. Deploying a WAF rule to block uploads of server-executable extensions (.jsp, .jspx, .war, .class) to the upload endpoint provides a secondary filter with low operational cost but may be bypassed by extension obfuscation. Ensuring uploaded files are stored outside the web root or in a directory without execute permissions prevents direct webshell access even if an arbitrary file is uploaded. The public POC is documented at https://github.com/zyhzheng500-maker/cve/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md and should be reviewed for the specific upload path to inform WAF rule targeting.