Vulnerability · Published Dec 29, 2025 · Assigned by VulDB

CVE-2025-15197code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload

Medium 4.7

In plain English

A medium-severity unrestricted file upload in Content Management System from anirbandutta9. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 72.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects unknown code of the file /admin/editposts.php. Performing manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Affected products (as reported)

Vendor	Product	Versions
code-projects	Content Management System	1.0
code-projects	News-Buzz	1.0
anirbandutta9	Content Management System	1.0
anirbandutta9	News-Buzz	1.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-338584 | code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload vdb-entry, technical-description
VDB-338584 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #724721 | Code-projects Content Management System v1.0 Arbitrary file upload vulnerability third-party-advisory
https://github.com/Limingqian123/CVE/issues/7 exploit, issue-tracking