Description
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Melis Technology | Melis Platform | < 5.3.1 | 5.3.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
tempiltin/CVE-2025-10353-POC ★ 2 · Feb 23, 2026
-
ivansmc/CVE-2025-10353-POC ★ 1 · Oct 8, 2025
Exploit for CVE-2025-10353. Unauthenticated File Upload on Melis Platform Framework that leads to RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution http/cves/2025/CVE-2025-10353.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | melisplatform/melis-cms-slider | < 5.3.1 | 5.3.1 | GHSA-chw4-gjvw-3gxc |