CVE-2025-55743 - CVE House
Back to Database
Status published High CVE-2025-55743

UnoPim vulnerable to remote code execution through Arbitrary File upload

Vulnerability Description

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The vulnerability is fixed in 0.2.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55743

Credits & Attribution

No credits recorded in the NVD database.

References

More from unopim

View All →
CVE-2025-55745
UnoPim Quick Export feature is vulnerable to CSV injection
Low 2.5
CVE-2025-55744
UnoPim vulnerable to CSRF on Product edit feature and creation of other types
Medium 6.9
CVE-2025-55742
UnoPim Stored XSS via SVG MIME/Sanitizer Bypass
High 8
CVE-2025-55741
unopim/unopim allows unauthorized product deletion via mass-delete endpoint
High 8.1
CVE-2024-52305
UnoPim Stored XSS : Cookie hijacking through Create User function
Medium 6.5

Affected Vendor

Affected Software

unopim
Vulnerable Versions:
< 0.2.1

Timeline

Official Publish: August 21st, 2025
Last Modified: August 21st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact