CVE-2025-56295

HighCVSS 7.3

Published: 16/09/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

A file upload vulnerability exists in Computer Laboratory System 1.0. Staff can upload PHP backdoor files when modifying personal avatar information and use web shell tools to gain server access.

Risk Assessment

An attacker can take over the server, steal data, or install additional malware, compromising the confidentiality and integrity of the system.

Recommendation

Immediately restrict the upload of executable files (e.g., PHP) in user profiles and implement file type validation and antivirus scanning.

Other vulnerabilities in Computer Laboratory System

CVE-2025-60307Critical
A SQL injection vulnerability has been discovered in code-projects Computer Laboratory System 1.0. Entering a universal password in the Password field on the login page can bypass authentication.

Original NVD description (English source)

code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor files when modifying personal avatar information and use web shell connection tools to obtain server permissions.