PT-2025-38637 · Selleo · Selleo Mentingo

Khanmarshal · Published 2025-09-20 · Updated 2025-09-20 · CVE-2025-10741

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Selleo Mentingo versions prior to 2025.08.28

Description A security issue has been identified in Selleo Mentingo. The vulnerability resides in an unknown function within the Profile Picture Handler component. Manipulation of the userAvatar argument allows for unrestricted file upload, and the attack can be performed remotely. The exploit has been publicly disclosed, and the vendor was notified but did not respond.

Recommendations Versions prior to 2025.08.28: Restrict or disable the use of the Profile Picture Handler component until a resolution is available. Avoid uploading files through the userAvatar argument.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-10741

Affected Products

Selleo Mentingo

References · 8

• 🔥 https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10741 · Security Note
• https://twitter.com/CVEnew/status/1969482352650043511 · Twitter Post
• https://gist.github.com/KhanMarshaI/ba3e74b331ce4ab602a5a22a59aaf819 · Note
• https://t.me/CVEtracker/32996 · Telegram Post
• https://vuldb.com/?ctiid.325068 · Note
• https://vuldb.com/?id.325068 · Note
• https://vuldb.com/?submit.645385 · Note