CVE-2025-15495

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
BiggiDroid	Simple PHP CMS	1.0

References

https://gitee.com/hdert/ck/issues/IDGO28Exploit, Issue Tracking
https://github.com/Asim-QAZi/RCE-Simplephpblog-biggiedroidExploit, Third Party Advisory
https://vuldb.com/?ctiid.340273Permissions Required, VDB Entry
https://vuldb.com/?id.340273Third Party Advisory, VDB Entry
https://vuldb.com/?submit.725890Third Party Advisory, VDB Entry
https://vuldb.com/?submit.726040Third Party Advisory, VDB Entry
https://github.com/Asim-QAZi/RCE-Simplephpblog-biggiedroidExploit, Third Party Advisory

Timeline

Published: Jan 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-154969.8A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulat CVE-2025-154973.8Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resultin CVE-2025-154989.3Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated atta CVE-2025-154999.8A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function u CVE-2025-15509.8The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .k CVE-2025-155009.8A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of CVE-2025-155019.8A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.get CVE-2025-155029.8A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function Sess CVE-2025-155039.8A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown f CVE-2025-155045.5A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parse_binary of the fi CVE-2025-155052.4A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Inte CVE-2025-155063.3A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression o