What is the CVSS score of CVE-2025-25940?

CVE-2025-25940 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of Java are affected by CVE-2025-25940?

Organizations using VisiCut 2.1 face critical risk from CVE-2025-25940, a insecure deserialization vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2025-25940?

Yes, a public proof-of-concept exploit is available for CVE-2025-25940. Prioritise patching immediately. EPSS: 1.3%.

How to fix or mitigate CVE-2025-25940?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Java CVE-2025-25940

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-03-10 cve@mitre.org

Java

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:50 vuln.today

PoC Detected

Jun 23, 2025 - 20:05 vuln.today

Public exploit code

CVE Published

Mar 10, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.

AnalysisAI

VisiCut 2.1 allows remote code execution through insecure XML deserialization in the loadPlfFile method. An attacker who can supply a crafted PLF file can execute arbitrary Java code on the victim's machine. A public PoC exploit exists and no patch is available.

Technical ContextAI

The loadPlfFile method in VisicutModel.java processes PLF files (XML-based project files) using Java deserialization without restricting which classes can be instantiated (CWE-502). Gadget chains in common Java libraries can be leveraged for code execution.

Affected ProductsAI

VisiCut 2.1

RemediationAI

Avoid opening PLF files from untrusted sources. Run VisiCut in a sandboxed environment. Monitor the VisiCut project for security updates.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-502 – Deserialization of Untrusted Data

View all

CVE-2021-35464 CRITICAL POC

9.8

CVE-2020-10189 CRITICAL POC

9.8

CVE-2019-18935 CRITICAL POC

9.8

CVE-2015-7450 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

CVE-2021-42237 CRITICAL POC

9.8

CVE-2025-24016 CRITICAL POC

9.9

CVE-2025-25940 vulnerability details – vuln.today

Back

Java CVE-2025-25940

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

More in Java

Same weakness CWE-502 – Deserialization of Untrusted Data

Share

External POC / Exploit Code