CVE-2025-67325

🚨 Ejecución remota de código no autenticada RCE mediante carga de archivos 📌 Resumen Proyecto: QloApps Repositorio: https://github.com/Qloapps/QloApps Versiónes afectadas: = 1.7.0 Clase de vulnerabilidad: Ejecución remota de código no autenticada Gravedad: Crítica CVSS v3.1: Crítica 9.8...

CVE-2025-67325: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution...

CVE-2025-67325

Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution...

CVE-2025-67325

QloApps versions 1.7.0 and earlier are vulnerable to unrestricted file upload within the hotel review feature, specifically at the /module/qlohotelreview/default endpoint. The root cause is a lack of file extension validation, allowing uploaded files to be executed directly by the server without ...