CVE Feed

    Dashboard / CVE / CVE-2025-2494

    CVE-2025-2494

    Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/phpconsole/upload.php’ endpoint, which is protected by basic HTTP authentication. The files are uploaded to a directory exposed by the web application, which could result in code execution, giving the attacker full control over the server.

    Published:Mar 18, 2025
    Last Modified:Oct 21, 2025
    EPS:Mar 18, 2025
    EPSS Score:0.00464
    CVSS Score:9.8

    Affected Products

    Vendor
    Sytel
    Product
    Softdial Contact Center

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High