CVE-2025-0463

Summary

CVE-2025-0463 is a newly disclosed critical vulnerability affecting Shanghai Lingdang Information Technology's CRM up to version 8.6.0.0. The issue lies within an unknown function of the file /crm/weixinmp/index.php and permits unrestricted uploads through manipulation of a specific argument name. This vulnerability can be exploited remotely, increasing the severity of the risk. The attack vector has been made public, and the vendor has yet to respond to concerns or provide a patch. Therefore, it is advised that affected organizations take immediate action to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.