by Kastro
Paper/Archive/CVE-2025-7895

CVE-2025-7895

harry0703 MoneyPrinterTurbo — harry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted upload

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.3.393 × 207.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file app/controllers/v1/video.py of the component File Extension Handler. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely.

Affected

ProductAffectedFixed inSource
MoneyPrinterTurbo1.2.0–CNA
MoneyPrinterTurbo1.2.1–CNA
MoneyPrinterTurbo1.2.2–CNA
MoneyPrinterTurbo1.2.3–CNA
MoneyPrinterTurbo1.2.4–CNA
MoneyPrinterTurbo1.2.5–CNA
MoneyPrinterTurbo1.2.6–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.317010refvuldb.com/?ctiid.317010writeupvuldb.com/?submit.608940