CVE-2025-14530

HighCVSS 7.2/10Last modified Oct 7, 2026

Description

A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Real Estate Property Listing App	1.0

References

https://github.com/zzdzz7/cve/issues/2Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.335871Permissions Required, VDB Entry
https://vuldb.com/?id.335871Third Party Advisory, VDB Entry
https://vuldb.com/?submit.703238Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/zzdzz7/cve/issues/2Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 11, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-145314.3A vulnerability was found in code-projects Rental Management System 2.0. This affects an unknown function of the file Transaction.java of th CVE-2025-145329.8DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction CVE-2025-145339.8The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.CVE-2025-145349.8A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap of CVE-2025-145359.8A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigFastDirect CVE-2025-145369.8A security flaw has been discovered in code-projects Class and Exam Timetable Management 1.0. Affected by this vulnerability is an unknown f CVE-2025-145379.8A weakness has been identified in code-projects Class and Exam Timetable Management 1.0. Affected by this issue is some unknown functionalit CVE-2025-145383.5A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCustomer of the file Cus CVE-2025-145395.4The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This i CVE-2025-14545.4The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2025-145404.3The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json fu CVE-2025-145417.2The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the co