Vulnerability · Published Oct 7, 2025 · Assigned by VulDB
CVE-2025-11354code-projects Online Hotel Reservation System addslideexec.php unrestricted upload
Medium 6.3
In plain English
A medium-severity unrestricted file upload in Online Hotel Reservation System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 65.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Online Hotel Reservation System | 1.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-327239 | code-projects Online Hotel Reservation System addslideexec.php unrestricted upload vdb-entry, technical-description
- VDB-327239 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #664924 | code-projects Online Hotel Reservation System V1.0 Unrestricted Upload third-party-advisory
- https://github.com/zhicat/C/issues/31 exploit, issue-tracking
- https://code-projects.org/ product