JoeyBling SpringBoot_MyBatisPlus CVE-2025-7487

Q: What is the CVSS score of CVE-2025-7487?

CVE-2025-7487 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21230 LOW

Improper Access Control (CWE-284)

2025-07-12 cna@vuldb.com

Authentication Bypass File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21230

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

CVE Published

Jul 12, 2025 - 19:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

AnalysisAI

Unrestricted file upload in SpringBoot_MyBatisPlus through commit a6a8255 allows authenticated remote attackers to upload arbitrary files via the portraitFile parameter at /file/upload. A public exploit exists, but EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed. The impact is rated low by the provided CVSS vector, though typical unrestricted uploads can lead to code execution.