CVE-2025-5840

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_update_customer_order.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to initiate the attack remotely.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Client Database Management System	1.0

References

https://github.com/592833263/cve/issues/1Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.311583Permissions Required, VDB Entry
https://vuldb.com/?id.311583Third Party Advisory, VDB Entry
https://vuldb.com/?submit.591425Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Jun 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-584008.4RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user wit CVE-2025-584015.1Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauth CVE-2025-584027.5The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the pa CVE-2025-584035.1CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenti CVE-2025-584056.1The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-bas CVE-2025-584064.3The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MI CVE-2025-584077.4Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trig CVE-2025-584085.9Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to ke CVE-2025-584093.5Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical m CVE-2025-58416.4The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and inc CVE-2025-584107.5Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers export CVE-2025-584118.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference coun