Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-10741: Selleo Mentingo: Unrestricted File Upload via Profile Picture Handler

CVE-2025-10741 · published 1 year ago

Summary

A security issue in Selleo Mentingo allows hackers to upload any file to the system without restrictions. This means they could potentially upload malicious files that could harm your site or steal user data. To protect yourself, update Selleo Mentingo to a version released after 2025.08.27 or contact your vendor for assistance.

Original advisory text

A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-434Unrestricted File Upload

Timeline

Published20 Sep 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-10741 · NVD

Track software like this

Free during beta