What is CVE-2025-9060?

CVE-2025-9060 is a critical-severity vulnerability in Msoft Mflash, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2025-08-15.

How severe is CVE-2025-9060?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Improper input validation in Msoft Mflash

CVE-2025-9060

A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.005 (39.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Msoft Mflash — versions 8.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

vulnerability@kaspersky.com

Frequently asked questions

What is CVE-2025-9060?: CVE-2025-9060 is a critical-severity vulnerability in Msoft Mflash, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2025-08-15.
How severe is CVE-2025-9060?: Critical severity. CVSS v3 base score is 9.1 out of 10.