CVE-2025-63695

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Nov 18, 2025

CISA due date

—

The record

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.

Ecosystem	Package	Introduced	Fixed