CVE-2025-7124

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-712405.4SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScr CVE-2025-712416.1SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by t CVE-2025-712426.5SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check au CVE-2025-712439.8The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulner CVE-2025-712446.1SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, w CVE-2025-71257.2A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an CVE-2025-712517.5In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional ex CVE-2025-712527.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712537.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712547.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712557.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712567.5In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privile