CVE-2025-10353
published 2025-10-08CVE-2025-10353: File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker…
PriorityP182critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
2.66%
85.0th percentile
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| melis_technology | melis_platform | < 5.3.1 | 5.3.1 |
| melisplatform | melis-cms-slider | >= 0 < 5.3.1 | 5.3.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for POST requests to the endpoint /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm with a multipart/form-data body containing the 'mcsdetail_img' parameter, which is the upload vector for this RCE vulnerability. ↗
- →After a successful upload, the malicious file is accessible under /media/sliders/0/<filename>. Monitor GET requests to this path for unexpected file types (e.g., PHP webshells). ↗
- →Detect Melis Platform instances exposed on the internet using the Shodan dork http.html:"/melis/MelisCms" or FOFA query body="/melis/MelisCms" || body="MelisDemoCms" to identify attack surface. ↗
- →A successful exploit response contains 'success' or 'uploaded' in the response body with HTTP 200, followed by a second HTTP 200 response confirming the uploaded file is retrievable from /media/sliders/0/. ↗
- ·The vulnerability is unauthenticated (PR:N, UI:N per CVSS), meaning no credentials are required to exploit the file upload endpoint. Ensure the endpoint is not publicly accessible without authentication. ↗
- ·The Nuclei template is marked 'intrusive' — running it against a target will actually upload a file. Use only in authorized testing environments. ↗
CVSS provenance
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Melis Platform CMS Unauthenticated File Upload Leading to RCE
ghsa·2025-10-08
CVE-2025-10353 [CRITICAL] CWE-43 Melis Platform CMS Unauthenticated File Upload Leading to RCE
Melis Platform CMS Unauthenticated File Upload Leading to RCE
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
OSV
Melis Platform CMS Unauthenticated File Upload Leading to RCE
osv·2025-10-08
CVE-2025-10353 [CRITICAL] Melis Platform CMS Unauthenticated File Upload Leading to RCE
Melis Platform CMS Unauthenticated File Upload Leading to RCE
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
VulnCheck
Path Equivalence: 'filename....' (Multiple Trailing Dot)
vulncheck·2025·CVSS 9.3
CVE-2025-10353 [CRITICAL] Path Equivalence: 'filename....' (Multiple Trailing Dot)
Path Equivalence: 'filename....' (Multiple Trailing Dot)
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
Affected: Melis Technology Melis Platform
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-10&host_type=src&vulnerability=cve-2025-10353; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?d
No detection rules found.
Nuclei
Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution
nuclei·CVSS 9.3
CVE-2025-10353 [CRITICAL] Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution
Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution
Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetail_img' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload malicious files and achieve remote code execution, exploit requires crafted POST request.
Template:
id: CVE-2025-10353
info:
name: Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution
author: ohmygod20260203
severity: critical
description: |
Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetail_img' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload
2025-10-08
Published
Exploited in the wild