CVE-2025-15262
BiggiDroid Simple PHP CMS Site Logo edit.php unrestricted upload
- State
- Published
- Severity
- 5.1 Medium
- Published
- Dec 30, 2025
- Updated
- Feb 24, 2026
- Reserved
- Dec 29, 2025
Description
A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Simple PHP CMSBiggiDroid |
|
References
- VDB-338656 | BiggiDroid Simple PHP CMS Site Logo edit.php unrestricted uploadvdb-entrytechnical-description
- VDB-338656 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #725815 | BiggiDroid Simple PHP CMS 1.0 SQL Injectionthird-party-advisory
- https://gitee.com/shanyaohei/black-yam/issues/IDGML9exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.