CVE-2025-14642

A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the file technical_staff_pic.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0

2.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-25)

CWEs

CWE-434, CWE-284

Published

2025-12-14

Modified

2026-10-07

Record from

the NVD, synced 2026-10-19

Affected

• carmelo:computer_laboratory_system

References

• https://code-projects.org/
• https://github.com/Yohane-Mashiro/cve/blob/main/upload%204.md
• https://vuldb.com/?ctiid.336375
• https://vuldb.com/?id.336375
• https://vuldb.com/?submit.707866

Check your stackJSON