CVE-2025-12593
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An unrestricted file upload vulnerability was identified in Simple Online Hotel Reservation System 2.0 in /admin/edit_room.php (Photo Handler component). The attack can be carried out remotely and a public exploit is available.
Risk Assessment
A publicly available exploit allows remote upload of a malicious file, potentially leading to code execution or system compromise.
Recommendation
Apply a patch or replace the vulnerable component as soon as possible, and restrict admin panel access and validate uploaded files until updated.
Other vulnerabilities in Simple Online Hotel Reservation System
See all- CVE-2025-12594Medium
A SQL injection flaw was discovered in Simple Online Hotel Reservation System 2.0 in /admin/add_account.php via manipulation of the Name argument. The attack can be performed remotely and a public exploit is available.
- CVE-2025-60308Medium
A Cross Site Scripting (XSS) vulnerability was found in the Add Room function of Simple Online Hotel Reservation System 1.0. Malicious JavaScript entered in the Description field can leak administrator cookies when viewing room details.
Original NVD description (English source)
A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit_room.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS