CVE-2025-12378 MEDIUM

CVE-2025-12378: code-projects Simple Food Ordering System addproduct.php unrestricted upload

Vendor Code-Projects
Product Simple Food Ordering System
Weakness CWE-434 · Unrestricted file upload
Published October 28, 2025
Last update October 28, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. Performing manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Key dates

02Disclosure timeline

October 28, 2025 CVE published
October 28, 2025 Record updated