CVE-2025-2396

HIGH

e-Excellence U-Office Force < 28.0 - Authenticated Arbitrary File Upload and Remote Code Execution

Title source: llm
STIX 2.1

Description

The U-Office Force from e-Excellence has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10013-0d371-1.html
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/en/cp-139-10014-69aa5-2.html

Scores

CVSS v3 8.8
EPSS 0.0062
EPSS Percentile 45.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
edetw/u-office_force < 28.0
Published Mar 17, 2025
Tracked Since Feb 18, 2026