CVE-2025-12201

Katalog CVE

CVSS 7.2 · High EPSS 0,57%

Kerentanan Improper Access Control pada ajayrandhawa user-management-php-mysql. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

27 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.329871 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.673156 advisory pihak ketiga · vdb entry
• https://github.com/Lianhaorui/Report/blob/main/FileUpload.docx exploit
• https://vuldb.com/?ctiid.329871 permissions required · vdb entry