CVE-2025-7181

code-projects Staff Audit System test.php unrestricted upload

A vulnerability, which was classified as critical, was found in code-projects Staff Audit System 1.0. Affected is an unknown function of the file /test.php. The manipulation of the argument uploadedfile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

code-projects · Staff Audit System

CVSS v4.0 VULDB

2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 VULDB

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2025-07-08

Proof-of-concept exploits (1)

• kn1g78/cve/blob/main/staff2/staff2.md1★ · 2025-06-30

Security advisories

• https://vuldb.com/?id.315120
• https://vuldb.com/?submit.606917
• https://code-projects.org

References

• CVE Record
• NVD entry

Related

• CVE-2025-1104
• CVE-2025-7175
• CVE-2025-7178
• CVE-2025-7180