CVE-2025-31340 - Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP Program · CoreCVE

Back Back to CVE browser

CRITICAL

Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP Program

Published Apr 17, 2025

9.9

CRITICAL

CVSS 4.0

EPSS 0.48%

Description

A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.

Affected products

Vendor SUNNET Technology Co., Ltd. Product Wisdom Master Pro Default
affected
- Version
  5.0
  Status
  affected
  Constraints
  <=5.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SUNNET Technology Co., Ltd.

Wisdom Master Pro

affected

Version	Status	Constraints
5.0	affected	<=5.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-98

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-11525
Advisory
https://zuso.ai/advisory/za-2025-03
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-11525		Advisory
https://zuso.ai/advisory/za-2025-03		third-party-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ZUSO ART

Published Apr 17, 2025

Updated Apr 17, 2025

Reserved Mar 28, 2025

Link CVE-2025-31340

CISA Vulnrichment

Updated Apr 17, 2025

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-31340

Severity n/a

Public date n/a

Links CVE-2025-31340

Assigner ZUSO ART

Published Apr 17, 2025

Updated Apr 17, 2025

Exploited since n/a

Link EUVD-2025-11525

EUVD-2025-11525