CVE-2025-6667

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add_cars.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
code-projects	Car Rental System	1.0

References

https://code-projects.org/Product
https://github.com/zzb1388/cve/issues/12Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.313880Permissions Required, VDB Entry
https://vuldb.com/?id.313880Third Party Advisory, VDB Entry
https://vuldb.com/?submit.602325Third Party Advisory, VDB Entry
https://github.com/zzb1388/cve/issues/12Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-666758.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac CVE-2025-666766.2An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-666789.8An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu CVE-2025-66689.8A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part CVE-2025-666807.1An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files v CVE-2025-666866.1A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges CVE-2025-666877.5Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files CVE-2025-666896.5A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the syst CVE-2025-66693.7A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of CVE-2025-666927.5A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial CVE-2025-666988.6An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.CVE-2025-66708.8A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing