CVE-2025-60947 HIGH

CVE-2025-60947: Census CSWeb arbitrary file upload

Vendor Census

Product CSWeb

Weakness CWE-434 · Unrestricted file upload

Published March 23, 2026

Last update March 25, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fixed in 8.1.0 alpha.

Key dates

02Disclosure timeline

March 23, 2026 CVE published

March 25, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-60947 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-1261 Juanpao JPShop API ComboController.php actionIndex unrestricted upload CVE-2025-4926 PHPGurukul Car Rental Project post-avehical.php unrestricted upload CVE-2025-47577 WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability CVE-2021-35002 BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability CVE-2026-1021 Gotac｜Police Statistics Database System - Arbitrary File Upload