Forwarded from Taiwan Computer Network Emergency Response Team/Coordination Center TWCERTCC-200-202507-00000024
[Fiyun Tech | Multi-functional Smart Campus Platform - Missing Authorization] (CVE-2025-8322, CVSS: 8.8) A Missing Authorization vulnerability exists in the Fiyun Tech Multi-functional Smart Campus Platform. A remote attacker with general user permissions can directly access administrator functions, including adding, modifying, and deleting accounts, and can even elevate any account to a system administrator.
[Fiyun Tech | Multi-functional Smart Campus Platform - Arbitrary File Upload] (CVE-2025-8323, CVSS: 8.8) An Arbitrary File Upload vulnerability exists in the Fiyun Tech Multi-functional Smart Campus Platform. A remote attacker with general user permissions can upload and execute web backdoor programs, thereby executing arbitrary code on the server.