CVE-2025-4468

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument userImage leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Online Student Clearance System	1.0

References

https://github.com/Colorado-all/cve/blob/main/Online%20Student%20Clearance%20System/upload.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.308087Permissions Required, VDB Entry
https://vuldb.com/?id.308087Third Party Advisory, VDB Entry
https://vuldb.com/?submit.566246Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: May 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-44695.4A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown funct CVE-2025-44705.4A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is CVE-2025-44717.8A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Affected by this is CVE-2025-44727.8A vulnerability was found in code-projects Departmental Store Management System 1.0. It has been classified as critical. Affected is the fun CVE-2025-44738.8The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() fu CVE-2025-44748.8The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting CVE-2025-44764.3A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client r CVE-2025-44777.2The ThreatSonar Anti-Ransomware from TeamT5 has a Privilege Escalation vulnerability, allowing remote attackers with intermediate privileges CVE-2025-447796.6An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.CVE-2025-44786.5A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. Th CVE-2025-44795.4The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image compar CVE-2025-44807.8A vulnerability was found in code-projects Simple College Management System 1.0. It has been declared as critical. This vulnerability affect