PT-2025-19335 · Unknown · Zhangyanbo2007 Youkefu

Serein123Y · Published 2025-05-05 · Updated 2025-10-10 · CVE-2025-4260

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions zhangyanbo2007 youkefu version 4.2.0 and earlier

Description A vulnerability was found in the function impsave of the file mwebhandleradminsystemTemplateController.java. The manipulation of the argument dataFile leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For zhangyanbo2007 youkefu version 4.2.0 and earlier, consider disabling the impsave function in the TemplateController.java file until a patch is available. Restrict access to the dataFile argument to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-4260

Affected Products

Zhangyanbo2007 Youkefu

References · 10

• 🔥 https://github.com/Serein123y/vulnerability/blob/main/vul.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4260 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4260 · Vendor Advisory
• https://vuldb.com/?submit.562902 · Note
• https://t.me/cvedetector/24432 · Telegram Post
• https://twitter.com/CVEnew/status/1919235917568528830 · Twitter Post
• https://t.me/cveNotify/138199 · Telegram Post
• https://vuldb.com/?ctiid.307364 · Note
• https://vuldb.com/?id.307364 · Note
• https://t.me/cvetracker/23025 · Telegram Post