CVE-2025-29017

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-290184.8A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking SystCVE-2025-29028.3Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual StorageCVE-2025-290299.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function.CVE-2025-29038.5An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can logCVE-2025-290309.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.CVE-2025-290319.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function.CVE-2025-290325.9Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function.CVE-2025-290337.3An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parCVE-2025-290365.9An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.CVE-2025-290397.2An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8CVE-2025-290409.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737cCVE-2025-290419.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710c