CVE-2025-11347

7.3 HIGH

Published: October 07, 2025 Modified: October 14, 2025

Description

A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of the component Add Student Page/Edit Student Page. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://code-projects.org/

Source: cna@vuldb.com

Product

https://github.com/romatdibrohiksnov/vulndb.com/tree/main/Student-Registration-Crud-Operation%20Unauthenticated%20Arbitrary%20File%20Upload%20leads%20to%20Remote%20Code%20Execution

Source: cna@vuldb.com

Exploit Third Party Advisory

https://vuldb.com/?ctiid.327232

Source: cna@vuldb.com

Permissions Required VDB Entry

https://vuldb.com/?id.327232

Source: cna@vuldb.com

Third Party Advisory VDB Entry

https://vuldb.com/?submit.664897

Source: cna@vuldb.com

Third Party Advisory VDB Entry

5 reference(s) from NVD

Quick Stats

CVSS v3 Score

7.3 / 10.0

EPSS (Exploit Probability)

0.1%

20th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-284 CWE-434 CWE-434

Affected Vendors

code-projects

Related CVEs

CVE-2025-69261 N/A

CVE-2025-69257 6.7

CVE-2025-69210 N/A

CVE-2025-66823 N/A

CVE-2025-50343 N/A