CVE-2025-15152 h-moses moga-mall PmsProductController.java addProduct unrestricted upload
Remote attackers can upload arbitrary files via the addProduct function in moga-mall, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15152?
CVE-2025-15152 is a medium-severity vulnerability in h-moses moga-mall, published on 28 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the file src/main/java/com/ms/product/controller/PmsProductController.java. Such manipulation of the argument objectName leads to unrestricted upload. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
Which versions are affected by CVE-2025-15152?
How do I fix CVE-2025-15152?
No fix has been published for CVE-2025-15152 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-15152 being exploited?
There is no known exploitation of CVE-2025-15152 in the wild and no public exploit code.
Sources
Also known as GHSA-qwmp-482q-vqpm.