Vulnerability · Published Oct 8, 2025 · Assigned by VulDB

CVE-2025-11470SourceCodester Hotel and Lodge Management System manage_website.php unrestricted upload

Medium 4.7

In plain English

A medium-severity unrestricted file upload in Hotel and Lodge Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.5%top 59.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the file /manage_website.php. The manipulation of the argument website_image/back_login_image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Hotel and Lodge Management System	1.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-327588 | SourceCodester Hotel and Lodge Management System manage_website.php unrestricted upload vdb-entry, technical-description
VDB-327588 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #665462 | SourceCodester Hotel and Lodge Management System 1.0 Unrestricted Upload third-party-advisory
https://github.com/TThuyyy/cve1/issues/13 exploit, issue-tracking
https://www.sourcecodester.com/ product