CVE-2025-5243 CRITICAL

CVE-2025-5243: Arbitrary File Upload in SMG Software's Information Portal

Vendor Smg Software
Product Information Portal
Weakness CWE-434 · Unrestricted file upload
Published July 24, 2025
Last update June 5, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information Portal: before 13.06.2025.

Key dates

02Disclosure timeline

July 24, 2025 CVE published
June 5, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-7500 itsourcecode Airline Reservation System admin_class.php save_settings unrestricted upload CVE-2023-5227 Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVE-2025-11456 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload CVE-2025-5840 SourceCodester Client Database Management System user_update_customer_order.php unrestricted upload