Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

Published: 24/03/2025 Updated: 24/03/2025

Unauthenticated File Upload Vulnerability in Digiwin ERP 5.1 with Remote Code Execution

A critical vulnerability exists in Digiwin ERP 5.1 within the /Api/FileUploadApi.ashx file. The DoUpload/DoWebUpload function has an unrestricted file upload flaw through manipulation of the File argument. This vulnerability can be triggered remotely, allowing attackers to upload files without proper restrictions. The issue has been publicly disclosed, and the potential for exploitation is high. Despite early notification, the vendor did not provide a response to address the security problem.

Vulnerable Product	Search on Vulmon	Subscribe to Product
digiwin erp

CWE-284 CWE-434 https://nvd.nist.gov https://www.first.org/epss https://github.com/Rain1er/report/blob/main/THNlcnBf/RCE_3.md https://github.com/Rain1er/report/blob/main/THNlcnBf/RCE_4.md https://vuldb.com/?ctiid.300726 https://vuldb.com/?id.300726 https://vuldb.com/?submit.516291

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2025-2705

Vulnerability Summary

References

Vulmon Search

About

Products

Connect