CVE-2025-3969

Katalog CVE

CVSS 9.8 · Critical EPSS 0,53%

Kerentanan Improper Access Control pada code-projects news publishing site dashboard. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-category.php of the component Edit Category Page. The manipulation of the argument category_image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

27 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zzZxby/Vulnerability-Exploration/blob/main/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A12.md exploit · advisory pihak ketiga
• https://vuldb.com/?id.306305 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.557287 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.306305 permissions required · vdb entry