Remote Code Execution Vulnerability in Melis Technology's Melis Platform
CVE-2025-10353

9.3CRITICAL

Key Information:

Vendor

Melis Technology

Status
Melis Platform
Vendor
CVE Published:
8 October 2025

Badges

đŸ‘Ÿ Exploit Exists🟡 Public PoC

What is CVE-2025-10353?

The 'melis-cms-slider' module within the Melis Platform is susceptible to a file upload vulnerability that can lead to remote code execution. An attacker can exploit this weakness by sending a crafted POST request containing a malicious file through the 'mcsdetail_img' parameter to the endpoint '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm'. This exploitation can allow the attacker to gain unauthorized control over the affected system, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Melis Platform 0 < 5.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-10353 - Proof of Concept

CVE-2025-10353
Created by ivansmc00

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...
https://github.com/ivansmc00/CVE-2025-10353-POC
exploit

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • đŸ‘Ÿ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

JesĂșs Manzano VĂĄzquez
Juan Manuel MartĂ­nez HernĂĄndez
Manuel IvĂĄn San MartĂ­n Castillo
Ángel Montilla Muñoz
JSON
.