CVE-2025-14641
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In the Computer Laboratory System 1.0 from code-projects, a vulnerability was found in the file admin/admin_pic.php, where manipulation of the argument image causes unrestricted upload. The attack may be initiated remotely, and the exploit has been published.
Risk Assessment
Similar to other vulnerabilities, unrestricted file upload may allow an attacker to upload malicious software and take control of the system.
Recommendation
It is recommended to immediately apply patches or restrict access to admin/admin_pic.php and validate uploaded files.
Other vulnerabilities in Computer Laboratory System
See all- CVE-2025-60307Critical
A SQL injection vulnerability has been discovered in code-projects Computer Laboratory System 1.0. Entering a universal password in the Password field on the login page can bypass authentication.
- CVE-2025-14642Medium
In the Computer Laboratory System 1.0 from code-projects, a vulnerability was found in the file technical_staff_pic.php, where manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-56295High
A file upload vulnerability exists in Computer Laboratory System 1.0. Staff can upload PHP backdoor files when modifying personal avatar information and use web shell tools to gain server access.
Original NVD description (English source)
A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of the file admin/admin_pic.php. This manipulation of the argument image causes unrestricted upload. The attack may be initiated remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS