CVE-2025-2973

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/student.php. The manipulation of the argument profile_image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-29745.4A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code o CVE-2025-297436.5D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.CVE-2025-297445.4pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.CVE-2025-297457.5A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NT CVE-2025-297466.1Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and CVE-2025-29755.4A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file S CVE-2025-297568.3SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devic CVE-2025-297579.4An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid CVE-2025-29765.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the componen CVE-2025-297664.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on arti CVE-2025-297684.4Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impac CVE-2025-297695.5libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence