Vulnerabilites related to Selleo - Mentingo
CVE-2025-10755 (GCVE-0-2025-10755)
Vulnerability from cvelistv5
Published
2025-09-20 21:02
Modified
2025-09-22 14:46
Severity ?
2.1 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| ▼ | URL | Tags |
|---|---|---|
| https://vuldb.com/?id.325069 | vdb-entry, technical-description | |
| https://vuldb.com/?ctiid.325069 | signature, permissions-required | |
| https://vuldb.com/?submit.645419 | third-party-advisory | |
| https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10755",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-22T14:46:44.201098Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-22T14:46:59.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Content-Type Handler"
],
"product": "Mentingo",
"vendor": "Selleo",
"versions": [
{
"status": "affected",
"version": "2025.08.27"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KhanMarshal (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in Selleo Mentingo 2025.08.27 entdeckt. Betroffen ist eine unbekannte Verarbeitung der Komponente Content-Type Handler. Durch die Manipulation des Arguments userAvatar mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Es ist m\u00f6glich, den Angriff aus der Ferne durchzuf\u00fchren. Die Ausnutzung wurde ver\u00f6ffentlicht und kann verwendet werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-20T21:02:05.774Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-325069 | Selleo Mentingo Content-Type unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.325069"
},
{
"name": "VDB-325069 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.325069"
},
{
"name": "Submit #645419 | Selleo Labs Sp. z o.o. Mentingo learn-v2025.08.27 File Upload Restriction Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.645419"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-20T08:25:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Selleo Mentingo Content-Type unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10755",
"datePublished": "2025-09-20T21:02:05.774Z",
"dateReserved": "2025-09-20T06:20:26.686Z",
"dateUpdated": "2025-09-22T14:46:59.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-10388 (GCVE-0-2025-10388)
Vulnerability from cvelistv5
Published
2025-09-14 03:32
Modified
2025-09-15 15:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component Create New Course Basic Settings. Such manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| ▼ | URL | Tags |
|---|---|---|
| https://vuldb.com/?id.323823 | vdb-entry, technical-description | |
| https://vuldb.com/?ctiid.323823 | signature, permissions-required | |
| https://vuldb.com/?submit.643623 | third-party-advisory | |
| https://gist.github.com/KhanMarshaI/584ae9d7ba8578ac040a0f89597fc3c1 | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10388",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T15:39:36.082624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T15:39:41.151Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/KhanMarshaI/584ae9d7ba8578ac040a0f89597fc3c1"
},
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/?submit.643623"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Create New Course Basic Settings"
],
"product": "Mentingo",
"vendor": "Selleo",
"versions": [
{
"status": "affected",
"version": "2025.08.27"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KhanMarshal (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component Create New Course Basic Settings. Such manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In Selleo Mentingo 2025.08.27 ist eine Schwachstelle entdeckt worden. Dabei betrifft es einen unbekannter Codeteil der Datei /api/course/enroll-course der Komponente Create New Course Basic Settings. Durch die Manipulation des Arguments Description mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-14T03:32:06.704Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-323823 | Selleo Mentingo Create New Course Basic Settings enroll-course cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.323823"
},
{
"name": "VDB-323823 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.323823"
},
{
"name": "Submit #643623 | Selleo Labs Sp. z o.o. Mentingo learn-v2025.08.27 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.643623"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/KhanMarshaI/584ae9d7ba8578ac040a0f89597fc3c1"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-13T11:45:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Selleo Mentingo Create New Course Basic Settings enroll-course cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10388",
"datePublished": "2025-09-14T03:32:06.704Z",
"dateReserved": "2025-09-13T09:40:01.463Z",
"dateUpdated": "2025-09-15T15:39:41.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-10741 (GCVE-0-2025-10741)
Vulnerability from cvelistv5
Published
2025-09-20 12:02
Modified
2025-09-22 13:55
Severity ?
2.1 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R
VLAI Severity ?
EPSS score ?
Summary
A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| ▼ | URL | Tags |
|---|---|---|
| https://vuldb.com/?id.325068 | vdb-entry, technical-description | |
| https://vuldb.com/?ctiid.325068 | signature, permissions-required | |
| https://vuldb.com/?submit.645385 | third-party-advisory | |
| https://gist.github.com/KhanMarshaI/ba3e74b331ce4ab602a5a22a59aaf819 | related | |
| https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b | exploit |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Selleo | Mentingo |
Version: 2025.08.0 Version: 2025.08.1 Version: 2025.08.2 Version: 2025.08.3 Version: 2025.08.4 Version: 2025.08.5 Version: 2025.08.6 Version: 2025.08.7 Version: 2025.08.8 Version: 2025.08.9 Version: 2025.08.10 Version: 2025.08.11 Version: 2025.08.12 Version: 2025.08.13 Version: 2025.08.14 Version: 2025.08.15 Version: 2025.08.16 Version: 2025.08.17 Version: 2025.08.18 Version: 2025.08.19 Version: 2025.08.20 Version: 2025.08.21 Version: 2025.08.22 Version: 2025.08.23 Version: 2025.08.24 Version: 2025.08.25 Version: 2025.08.26 Version: 2025.08.27 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10741",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-22T13:54:41.231523Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-22T13:55:33.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Profile Picture Handler"
],
"product": "Mentingo",
"vendor": "Selleo",
"versions": [
{
"status": "affected",
"version": "2025.08.0"
},
{
"status": "affected",
"version": "2025.08.1"
},
{
"status": "affected",
"version": "2025.08.2"
},
{
"status": "affected",
"version": "2025.08.3"
},
{
"status": "affected",
"version": "2025.08.4"
},
{
"status": "affected",
"version": "2025.08.5"
},
{
"status": "affected",
"version": "2025.08.6"
},
{
"status": "affected",
"version": "2025.08.7"
},
{
"status": "affected",
"version": "2025.08.8"
},
{
"status": "affected",
"version": "2025.08.9"
},
{
"status": "affected",
"version": "2025.08.10"
},
{
"status": "affected",
"version": "2025.08.11"
},
{
"status": "affected",
"version": "2025.08.12"
},
{
"status": "affected",
"version": "2025.08.13"
},
{
"status": "affected",
"version": "2025.08.14"
},
{
"status": "affected",
"version": "2025.08.15"
},
{
"status": "affected",
"version": "2025.08.16"
},
{
"status": "affected",
"version": "2025.08.17"
},
{
"status": "affected",
"version": "2025.08.18"
},
{
"status": "affected",
"version": "2025.08.19"
},
{
"status": "affected",
"version": "2025.08.20"
},
{
"status": "affected",
"version": "2025.08.21"
},
{
"status": "affected",
"version": "2025.08.22"
},
{
"status": "affected",
"version": "2025.08.23"
},
{
"status": "affected",
"version": "2025.08.24"
},
{
"status": "affected",
"version": "2025.08.25"
},
{
"status": "affected",
"version": "2025.08.26"
},
{
"status": "affected",
"version": "2025.08.27"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KhanMarshal (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in Selleo Mentingo bis 2025.08.27 gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Komponente Profile Picture Handler. Mit der Manipulation des Arguments userAvatar mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz m\u00f6glich. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-20T12:02:06.199Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-325068 | Selleo Mentingo Profile Picture unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.325068"
},
{
"name": "VDB-325068 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.325068"
},
{
"name": "Submit #645385 | Selleo Labs Sp. z o.o. Mentingo learn-v2025.08.27 Unrestricted Upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.645385"
},
{
"tags": [
"related"
],
"url": "https://gist.github.com/KhanMarshaI/ba3e74b331ce4ab602a5a22a59aaf819"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-19T20:21:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Selleo Mentingo Profile Picture unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10741",
"datePublished": "2025-09-20T12:02:06.199Z",
"dateReserved": "2025-09-19T18:16:26.307Z",
"dateUpdated": "2025-09-22T13:55:33.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}