CVE-2025-11353

HighCVSS 8.8/10Last modified Oct 8, 2026

Description

A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Performing manipulation of the argument image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
code-projects	Online Hotel Reservation System	1.0

References

https://code-projects.org/Product
https://github.com/zhicat/C/issues/30Exploit, Issue Tracking
https://vuldb.com/?ctiid.327238Permissions Required, VDB Entry
https://vuldb.com/?id.327238Third Party Advisory, VDB Entry
https://vuldb.com/?submit.664920Third Party Advisory, VDB Entry

Timeline

Published: Oct 7, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-113549.8A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.CVE-2025-113558.8A vulnerability has been found in UTT 1250GW up to v2v3.2.2-200710. Affected by this vulnerability is the function strcpy of the file /gofor CVE-2025-113568.8A vulnerability was found in Tenda AC23 up to 16.03.07.52. Affected by this issue is the function sscanf of the file /goform/SetStaticRouteC CVE-2025-113578.8A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processing of the file /crea CVE-2025-113588.8A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Exec CVE-2025-113598.8A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the fi CVE-2025-113604.3A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js CVE-2025-113616.4The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forg CVE-2025-113627.5Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throt CVE-2025-113635.3The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to uploa CVE-2025-113656.5The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in a CVE-2025-113669.8N-central < 2025.4 is vulnerable to authentication bypass via path traversal