9.8
CVE-2025-28168
- EPSS 0.28%
- Veröffentlicht 05.05.2025 00:00:00
- Zuletzt bearbeitet 30.09.2025 17:01:40
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Multiple File Upload Project ≫ Multiple File Upload Version3.1.0 SwPlatformoutsystems
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.28% | 0.194 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| cve@mitre.org | 6.4 | 3.1 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-602 Client-Side Enforcement of Server-Side Security
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11
https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9