CVE-2025-14195
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A security flaw was discovered in code-projects Employee Profile Management System 1.0 allowing unrestricted file upload. Manipulating the per_file argument in /profiling/add_file_query.php enables remote attacks. The exploit has been released publicly and may be used.
Risk Assessment
An attacker can upload malicious files, potentially leading to system integrity compromise or arbitrary code execution. The public exploit increases the risk of attacks.
Recommendation
Restrict file upload capabilities, implement file type and size validation, and secure directories against script execution. Also monitor logs.
Other vulnerabilities in Employee Profile Management System
See all- CVE-2025-14222Medium
A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes SQL injection. The attack may be initiated remotely, and the exploit has been published and may be used.
- CVE-2025-14194Low
Employee Profile Management System 1.0 by code-projects has a cross-site scripting (XSS) vulnerability in /view_personnel.php. Manipulation of arguments per_address, dr_school, or other_school leads to XSS. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2025-14193Medium
A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing a manipulation of the argument per_id can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_query.php. The manipulation of the argument per_file results in unrestricted upload. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS