{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-05T02:56:13.803","vulnerabilities":[{"cve":{"id":"CVE-2025-52130","sourceIdentifier":"cve@mitre.org","published":"2025-08-25T20:15:40.700","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server."},{"lang":"es","value":"Vulnerabilidad de carga de archivos en WebErpMesv2 1.17 en el controlador app/Http/Controllers/FactoryController.php. Esta falla permite a un atacante autenticado cargar archivos arbitrarios, incluyendo scripts PHP, a los que se puede acceder mediante solicitudes GET directas, lo que podría provocar la ejecución remota de código (RCE) en el servidor web."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-616"}]}],"references":[{"url":"https://github.com/SMEWebify/WebErpMesv2","source":"cve@mitre.org"},{"url":"https://medium.com/@The_Hiker/wrong-variable-name-leads-to-rce-cve-2025-52130-8ff59a7d245c","source":"cve@mitre.org"}]}}]}