p PatchFirst

CVE-2025-10353

CVE-2025-10353 · Missing Authorization vulnerability in Melis Platform

This page contains facts from public vulnerability sources. Check the original advisory before updating.

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.

CVSS 9.3 · Critical · EPSS 2.7% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • melis platform

    Versions
    • ≥ 0, < 5.3.1: Affected (custom)

    Update to 5.3.1

  • melisplatform/melis-cms-slider Packagist

    Versions
    • v2.1
    • v2.1.1
    • v2.2.0
    • v2.2.1
    • v2.3.0
    • v2.3.1
    • v2.4.0
    • v2.5.0
    • v3.0.0
    • v3.0.1
    • v3.1.0
    • v3.1.1
    • v3.2.0
    • v3.2.1
    • v3.2.2
    • v4.0.0
    • v4.0.1
    • v4.0.2
    • v4.0.3
    • v4.1.0
    • v5.0.0
    • v5.0.1
    • v5.1.0
    • v5.2.0
    • v5.3.0
    Affected ranges
    • ECOSYSTEM: < 5.3.1

    Update to 5.3.1

Original sources

Check your server →