← Vulnerability feed

Vulnerability record · CVE-2025-15503 · published 10 January 2026

CVE-2025-15503: Sangfor operation and maintenance security management system improper access control vulnerability

Sangfor · Operation And Maintenance Security Management System

A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file /fort/trust/version/common/common.jsp. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

5.5 CVSS 4.0 Medium EPSS 2.1% · top 19.4% CWE-284 · Improper access controlCWE-434 · Unrestricted file upload
5.5CVSS 4.0 base score, v2 7.5
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file /fort/trust/version/common/common.jsp. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/master-abc/cve/issues/13 ExploitIssue TrackingThird Party Advisory
https://github.com/master-abc/cve/issues/13#issue-3770623333 ExploitIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.340348 Permissions RequiredVDB Entry
https://vuldb.com/?id.340348 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.727253 Third Party AdvisoryVDB Entry

Track CVE-2025-15503 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.9CVE-2025-15501Sangfor operation and maintenance security management system command injection vulnerabilityA vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of th…EPSS 7.0%7.4CVE-2026-1324Sangfor operation and maintenance security management system command injection vulnerabilityA vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionCon…EPSS 7.1%5.5CVE-2026-1412Sangfor operation and maintenance security management system injection vulnerabilityA vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown funct…EPSS 4.3%5.5CVE-2026-1325Sangfor operation and maintenance security management system weak password recovery vulnerabilityA security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_…EPSS 0.58%5.5CVE-2025-15502Sangfor operation and maintenance security management system command injection vulnerabilityA vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionContro…EPSS 6.1%2.1CVE-2026-1414Sangfor operation and maintenance security management system injection vulnerabilityA vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation…EPSS 4.9%2.1CVE-2026-1413Sangfor operation and maintenance security management system injection vulnerabilityA vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the…EPSS 3.1%2.1CVE-2025-12916Sangfor operation and maintenance security management system injection vulnerabilityA vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort…EPSS 5.1%

Source: NIST National Vulnerability Database (record CVE-2025-15503), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.