CVE-2025-1166

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file endpoint/update.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Food Menu Manager	1.0

References

https://gist.github.com/jmx0hxq/0ce2c97ca11b2423a203b5719438c9f8Exploit, Third Party Advisory
https://vuldb.com/?ctiid.295069Permissions Required, VDB Entry
https://vuldb.com/?id.295069Third Party Advisory, VDB Entry
https://vuldb.com/?submit.494567Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-116609.8A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by t CVE-2025-116619.8A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an un CVE-2025-116629.8A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking CVE-2025-116636.1A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the f CVE-2025-116649.8A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown funct CVE-2025-116659.8A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmw CVE-2025-116666.7A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmw CVE-2025-116678.8A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the fi CVE-2025-116687.2A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the fil CVE-2025-116698.1Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 ar CVE-2025-11679.8A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is so CVE-2025-116704.3Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by t