Which versions of iSoluçõesWEB are affected by EUVD-2025-17045?

Organizations using SoluçõesCoop iSoluçõesWEB should be aware of moderate risk from CVE-2025-5714, a path traversal vulnerability rated CVSS 4.3. This could allow unauthorized file access.

Is there a public PoC exploit available for EUVD-2025-17045?

Yes, a public proof-of-concept exploit is available for EUVD-2025-17045. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2025-17045?

Within 30 days: Identify affected systems running SoluçõesCoop iSoluçõesWEB and apply vendor patches as part of regular patch cycle. Review file handling controls.

iSoluçõesWEB EUVD-2025-17045

Q: What is the CVSS score of EUVD-2025-17045?

EUVD-2025-17045 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2025-5714 LOW

Path Traversal (CWE-22)

2025-06-06 cna@vuldb.com

PHP Path Traversal Solucoescoop

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Requires authentication (PR:L), low confidentiality impact, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17045

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

PoC Detected

Oct 01, 2025 - 15:30 vuln.today

Public exploit code

CVE Published

Jun 06, 2025 - 04:15 cve.org

LOW 2.1

CVE Published

Jun 06, 2025 - 04:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part of the file /sys/up.upload.php of the component Profile Information Update. The manipulation of the argument nomeArquivo leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

AnalysisAI

Path traversal in iSoluçõesWEB up to 20250516 allows authenticated attackers to read arbitrary files via the nomeArquivo parameter in /sys/up.upload.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.17%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability is a path traversal (CWE-22) in a PHP-based web application. The affected component is the profile information update functionality, where the nomeArquivo parameter is not properly sanitized, allowing directory traversal sequences (e.g., ../) to access files outside the intended directory. The CPE indicates the product is SoluçõesCoop iSoluçõesWEB, a Brazilian cooperative management system.

RemediationAI

Upgrade to the latest version of iSoluçõesWEB beyond 20250516 as recommended by the vendor. No specific patch version is provided. As a workaround, restrict access to /sys/up.upload.php to authenticated users only and validate the nomeArquivo parameter to prevent directory traversal (e.g., reject paths containing '..' or enforce a whitelist of allowed files). Note that blocking the endpoint may break profile update functionality.