High severity · published Mar 17, 2025
CVE-2025-2396
e-Excellence U-Office Force - Arbitrary File Upload
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
The U-Office Force from e-Excellence has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
U-Office Force · e-Excellence
before 28.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2396
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-10014-69aa5-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-10013-0d371-1.html
More from U-Office Force
9.8
CVE-2026-3422
e-Excellence｜U-Office Force - Insecure Deserialization
9.8
CVE-2025-2395
e-Excellence U-Office Force - Improper Authentication
9.8
CVE-2023-32757
e-Excellence U-Office Force - Arbitrary File Upload
8.8
CVE-2025-12865
e-Excellence｜U-Office Force - SQL Injection
8.8
CVE-2025-12864
e-Excellence｜U-Office Force - SQL Injection