by Kastro
Paper/Archive/CVE-2025-11948

CVE-2025-11948

Excellent Infotek Document Management System — Excellent Infotek｜Document Management System - Arbitrary File Upload

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.2.632 × 2012.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Affected

ProductAffectedFixed inSource
Document Management Systemall versions–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10452-72cb6-1.htmlwriteuptwcert.org.tw/en/cp-139-10453-43e63-2.htmlrefchtsecurity.com/news/3575ad9c-31f4-49de-8bc4-de85bb2eed39