CVE-2025-4735

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/product.php. The manipulation of the argument Picture leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: May 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-473507.8Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application.CVE-2025-473517.8Memory corruption while processing user buffers.CVE-2025-473527.8Memory corruption while processing audio streaming operations.CVE-2025-473537.8Memory corruption while processing request sent from GVM.CVE-2025-473547.8Memory corruption while allocating buffers in DSP service.CVE-2025-473557.8Memory corruption while invoking remote procedure IOCTL calls.CVE-2025-473567.8Memory Corruption when multiple threads concurrently access and modify shared resources.CVE-2025-473577.8Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.CVE-2025-473587.8Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.CVE-2025-473597.8Memory Corruption when multiple threads simultaneously access a memory free API.CVE-2025-47369.8A vulnerability was found in PHPGurukul Daily Expense Tracker 1.1 and classified as critical. Affected by this issue is some unknown functio CVE-2025-473607.8Memory corruption while processing client message during device management.