CVE-2025-12202

MediumCVSS 4.3

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability has been discovered in User-Management-PHP-MYSQL (up to commit fedcf58797bf2791591606f7b61fdad99ad8bff1). The vulnerability affects unknown code and can be exploited remotely. The exploit has been publicly released and may be used by attackers.

Risk Assessment

An attacker could force an authenticated user to perform unwanted actions in the application, potentially leading to data modification or account takeover. Due to the public exploit, the risk is high.

Recommendation

Implement anti-CSRF tokens in all forms and state-changing actions. Since the vendor did not respond to the disclosure, consider applying your own patches or switching to actively maintained software.

Other vulnerabilities in User-Management-PHP-MYSQL

CVE-2025-12201Medium
A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. It affects an unknown part of the file /admin/edit-user.php of the User Management Interface. Manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.

Original NVD description (English source)

A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS