CVE-2025-8256 MEDIUM

CVE-2025-8256: code-projects Online Ordering System product.php unrestricted upload

Vendor Code-Projects
Product Online Ordering System
Weakness CWE-434 · Unrestricted file upload
Published July 28, 2025
Last update July 28, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

July 28, 2025 CVE published
July 28, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-0863 WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE) CVE-2025-67968 WordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerability CVE-2024-50420 WordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerability CVE-2023-1479 SourceCodester Simple Music Player save_music.php unrestricted upload CVE-2024-5247 NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability