Vulnerability · Published Sep 2, 2025 · Assigned by VulDB

CVE-2025-9841code-projects Mobile Shop Management System AddNewProduct.php unrestricted upload

Medium 6.3

In plain English

A medium-severity unrestricted file upload in Mobile Shop Management System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 71.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Affected products (as reported)

Vendor	Product	Versions
code-projects	Mobile Shop Management System	1.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-322188 | code-projects Mobile Shop Management System AddNewProduct.php unrestricted upload vdb-entry, technical-description
VDB-322188 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #641779 | code-projects Mobile Shop Management System 1.0 Unrestricted Upload third-party-advisory
https://github.com/chen2496088236/CVE/issues/2 exploit, issue-tracking
https://code-projects.org/ product