CVE-2025-9841

code-projects Mobile Shop Management System AddNewProduct.php unrestricted upload

State: Published
Severity: 5.3 Medium
Published: Sep 2, 2025
Updated: Sep 3, 2025
Reserved: Sep 2, 2025

Description

A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-434 Unrestricted Upload
CWE-284 Improper Access Controls

Affected Products

Product	Versions
Mobile Shop Management Systemcode-projects	1.0Affected

References

VDB-322188 | code-projects Mobile Shop Management System AddNewProduct.php unrestricted uploadvdb-entrytechnical-description
VDB-322188 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #641779 | code-projects Mobile Shop Management System 1.0 Unrestricted Uploadthird-party-advisory
https://github.com/chen2496088236/CVE/issues/2exploitissue-tracking
https://code-projects.org/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.