CVE-2025-14522

🗓️ 11 Dec 2025 16:02:17Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

Unrestricted upload vulnerability in public Kindeditor upload_json.php via image file allows remote exploitation.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2025-14522	9 Jan 202602:01	–	circl
CNNVD	hfly 代码问题漏洞	11 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-14522 baowzh hfly upload_json.php unrestricted upload	11 Dec 202516:02	–	cvelist
EUVD	EUVD-2025-202705	11 Dec 202518:30	–	euvd
NVD	CVE-2025-14522	11 Dec 202516:16	–	nvd
Positive Technologies	PT-2025-50630	11 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-14522	12 Dec 202517:13	–	redhatcve
Vulnrichment	CVE-2025-14522 baowzh hfly upload_json.php unrestricted upload	11 Dec 202516:02	–	vulnrichment

NVD

Node

baowzh hflyRange≤2016-05-11

[
  {
    "vendor": "baowzh",
    "product": "hfly",
    "versions": [
      {
        "version": "638ff9abe9078bc977c132b37acbe1900b63491c",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20upload_json.php%20imgFile%20XSS-File-Upload.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
imgFile	request body	/Public/Kindeditor/php/upload_json.php	Unrestricted upload via manipulation of imgFile parameter in upload_json.php; remote attacker can upload arbitrary files.	CWE-284, CWE-434

29 Apr 2026 01:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.16.3 - 9.8

CVSS 45.3

CVSS 26.5

CVSS 36.3

EPSS0.00048

SSVC