CVE-2025-8859

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
code-projects	eBlog Site	1.0

References

https://code-projects.org/Product
https://github.com/unjoke/newvul/issues/1Exploit, Issue Tracking
https://vuldb.com/?ctiid.319399Permissions Required, VDB Entry
https://vuldb.com/?id.319399Third Party Advisory, VDB Entry
https://vuldb.com/?submit.628112Third Party Advisory, VDB Entry

Timeline

Published: Aug 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-88603.3A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `CVE-2025-88619.8TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete CVE-2025-88627.0YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigat CVE-2025-88637.0YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission CVE-2025-88646.8Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs CVE-2025-88654.1The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain CVE-2025-88665.1YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attack CVE-2025-88676.4The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget param CVE-2025-88688.8In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate CVE-2025-88695.9When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement P CVE-2025-88704.9On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 CVE-2025-88715.6The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deseriali