The vulnerability CVE-2025-22504 affects jumpdemand 4ECPS Web Forms versions up to 0.2.18 and involves unrestricted file upload functionality that does not properly restrict dangerous file types. This flaw allows attackers to upload web shells to the server hosting the application, which can be used to execute arbitrary code remotely. The CVSS 3.1 base score is 10.0, reflecting its critical nature with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and the product is not a cloud service.

Successful exploitation allows an unauthenticated attacker to upload malicious files such as web shells to the affected server. This can lead to remote code execution, full system compromise, data theft, and service disruption. The vulnerability affects confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality, implement strict file type validation, and monitor for suspicious uploads. Avoid exposing the vulnerable application to untrusted networks where possible.