CVE-2025-6870

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Content.php?f=service. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Simple Company Website	1.0

References

https://github.com/ez-lbz/poc/issues/26Exploit, Third Party Advisory
https://vuldb.com/?ctiid.314342Permissions Required
https://vuldb.com/?id.314342Third Party Advisory, VDB Entry
https://vuldb.com/?submit.603640Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Jun 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-687008.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (nor CVE-2025-687017.5Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivat CVE-2025-687027.5Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it sh CVE-2025-687037.5Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passp CVE-2025-687047.5Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is CVE-2025-687059.8RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal CVE-2025-687069.8A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMul CVE-2025-687078.8An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attac CVE-2025-687082.4SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock i CVE-2025-687095.2SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMa CVE-2025-68719.8A vulnerability classified as critical has been found in SourceCodester Simple Company Website 1.0. This affects an unknown part of the file CVE-2025-687102.4Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to