CVE-2025-30510

CRITICAL
Published Apr 15, 2025 Modified Nov 14, 2025 CWE-351

Description

An attacker can upload an arbitrary file instead of a plant image.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-351 CWE-351

Affected Products

Vendor Product
growatt cloud_portal

References

Frequently Asked Questions

What is CVE-2025-30510? +
An attacker can upload an arbitrary file instead of a plant image. It has a CVSS v3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2025-30510? +
CVE-2025-30510 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
What products are affected by CVE-2025-30510? +
CVE-2025-30510 affects products from growatt, specifically: cloud_portal. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2025-30510? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-54412

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain …
CVE-2025-54413

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain …
CVE-2025-31951 8.8

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's …
CVE-2025-65960 6.6

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users …
CVE-2024-4769 5.9

When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could …
CVE-2026-41341 5.4

OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2025-30510 — free, no signup required.

Start Free Scan