CVE-2025-9529
Campcodes Payroll Management System index.php include file inclusion
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 27, 2025
- Updated
- Aug 27, 2025
- Reserved
- Aug 27, 2025
Description
A weakness has been identified in Campcodes Payroll Management System 1.0. The affected element is the function include of the file /index.php. This manipulation of the argument page causes file inclusion. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-73 File Inclusion
Affected Products
| Product | Versions |
|---|---|
Payroll Management SystemCampcodes |
|
References
- VDB-321548 | Campcodes Payroll Management System index.php include file inclusionvdb-entrytechnical-description
- VDB-321548 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #635551 | Campcodes Payroll Management System v1.0 Improper Control of Filename for Include/Require Statement in PHthird-party-advisory
- https://github.com/chenjunjie3/cve/issues/6exploitissue-tracking
- https://www.campcodes.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.