CVE-2025-4561 HIGH

CVE-2025-4561: Kinfor KFOX - Arbitrary File Upload

Vendor Kinfor

Product KFOX

Weakness CWE-434 · Unrestricted file upload

Published May 12, 2025

Last update May 12, 2025

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Key dates

02Disclosure timeline

May 12, 2025 CVE published

May 12, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-4561 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-7864 thinkgem JeeSite FileUploadController.java upload unrestricted upload CVE-2023-5812 flusity CMS upload.php handleFileUpload unrestricted upload CVE-2026-4221 Tiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted upload CVE-2024-0699 AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url CVE-2024-47655 Unrestricted File Upload Vulnerability