CVE-2025-3552

Name of the Vulnerable Software and Affected Versions: Lingxing ERP version 2

Description: A critical issue has been identified, affecting an unknown part of the file /Api/TinyMce/UploadAjax.ashx. The manipulation of the File argument leads to unrestricted upload. This issue can be exploited remotely.

Recommendations: For Lingxing ERP version 2, as a temporary workaround, consider restricting access to the /Api/TinyMce/UploadAjax.ashx endpoint until a patch is available. Avoid using the File argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.