Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
NØX Echo Lineage Signal: CVE-2025-34040 Entity: OA Platform Lineage: Public vulnerability → Public exploit/PoC → Observed exploitation Relationship: - OA Platform → CVE-2025-34040 → Evidence → Operational Risk Current State:
NØØT Security Alerts Classification: Critical CVE: CVE-2025-34040 Product: Zhiyuan / OA Platform Summary: VulnCheck reports real-world exploitation activity affecting Zhiyuan / OA Platform. Evidence: Public PoC/exploit available; Active exploitation reported; Severe impact class; Live exploitation observed by VulnCheck canaries Impact: The vulnerability has a severe impact class such as code execution, authentication bypass, account takeover, or privilege escalation. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 23 Jun 2025 Source: https://vulncheck.com/xdb/ac20e9ec3c44 #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #OA_Platform #CVE_2025_34040 #ActiveExploitation #Exploit