Vulnerability · Published Dec 18, 2025 · Assigned by VulDB
CVE-2025-14885SourceCodester Client Database Management System Leads Generation user_leads.php unrestricted upload
Medium 6.3
In plain English
A medium-severity unrestricted file upload in Client Database Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads Generation Module. Executing manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Client Database Management System | 1.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-337373 | SourceCodester Client Database Management System Leads Generation user_leads.php unrestricted upload vdb-entry
- VDB-337373 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #715595 | SourceCodester Client Database Management System 1 Unrestricted Upload third-party-advisory
- https://medium.com/@rvpipalwa/remote-code-execution-rce-vulnerability-report-4394b38ff90e broken-link, exploit
- https://www.sourcecodester.com/ product