Read the docs
TI-2025-11786 Aliases CVE-2025-12867GHSA-rv6x-ghr7-v4f6

Hundred Plus｜EIP Plus - Arbitrary File Uplaod

Priority MEDIUM 40CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00677 52nd percentileScored 2026-11-07
Fix Fixed EIP Plus (Hundred Plus): RELEASE_240626

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hundred PlusEIP Plusbefore RELEASE_240626RELEASE_240626Patch availableCNA
  • EIP Plus VendorHundred Plus Affected before RELEASE_240626 Fixed in RELEASE_240626 Patch available CNA

Remediation

  • Fix · CNA EIP Plus (Hundred Plus) Fixed in RELEASE_240626

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Hundred Plus EIP Plus RELEASE_240626

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-11785 Hundred Plus｜EIP Plus - Weak Password Recovery MechanismPriority MEDIUM 49
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12867
  2. 2026-10-03 Alias added: GHSA-rv6x-ghr7-v4f6
  3. 2026-10-11 EPSS moved to the 50th–90th percentile

References

Advisory 2

  • TI-2025-11785 Hundred Plus｜EIP Plus - Weak Password Recovery Mechanism CVSS 4.0CRITICAL 9.3
  • TI-2021-12214 Hundred Plus 101EIP - Stored XSS-2 CVSS 3.1MEDIUM 5.4
  • TI-2021-12213 Hundred Plus 101EIP - Stored XSS-1 CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences