CVE-2025-12301

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
code-projects	Simple Food Ordering System	1.0

References

https://code-projects.org/Product
https://github.com/underatted/CVE/issues/22Exploit, Third Party Advisory
https://vuldb.com/?ctiid.329973Permissions Required, VDB Entry
https://vuldb.com/?id.329973Third Party Advisory, VDB Entry
https://vuldb.com/?submit.676087Third Party Advisory, VDB Entry

Timeline

Published: Oct 27, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-123026.1A vulnerability was detected in code-projects Simple Food Ordering System 1.0. The affected element is an unknown function of the file /edit CVE-2025-123034.8A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. The impacted element is an unknown function of the file admin-profi CVE-2025-123044.3A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function ali CVE-2025-123059.8A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/contro CVE-2025-123069.8A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.p CVE-2025-123079.8A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality CVE-2025-123089.8A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality o CVE-2025-123099.8A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php CVE-2025-12315.4Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user pa CVE-2025-123105.3A security vulnerability has been detected in VirtFusion up to 6.0.2. This vulnerability affects unknown code of the file /account/_settings CVE-2025-123114.8A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0. This issue affects some unknown processing of the file edit-CVE-2025-123124.8A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. Impacted is an unknown function of the file view-pass-detail.php. T