CVE-2025-7939 jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java addGoods unrestricted upload
An attacker can upload malicious files via the addGoods function in JPACookieShop, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-7939?
CVE-2025-7939 is a medium-severity vulnerability in jerryshensjf JPACookieShop 蛋糕商城JPA版, published on 21 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsController.java. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.
Which versions are affected by CVE-2025-7939?
It affects 1 product.
Products include Jerryshensjf Jpacookieshop.
How do I fix CVE-2025-7939?
No fix has been published for CVE-2025-7939 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-7939 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-7939 exists.
Other vulnerabilities in jerryshensjf JPACookieShop 蛋糕商城JPA版
- CVE-2025-8221 jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scripting
- CVE-2025-8223 jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgery
- CVE-2025-7938 jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorization
- CVE-2025-8222 jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scripting
Sources
Also known as GHSA-gch3-g2qp-mcxw.