CVE-2025-3969 — Vulnetix

CVE-2025-3969 PUBLISHED CVSS 5.300000190734863 MEDIUM

A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-category.php of the component Edit Category Page. The manipulation of the argument category_image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

EPSS 0.12% · 30.3th percentile

Risk Scores

CVSS 4.0

5.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS Score

0.12%

30.3th percentile

Affected Products

Vendor	Product	Versions
codeprojects	News Publishing Site Dashboard	1.0
code-projects	news_publishing_site_dashboard	1.0

Exploit Intelligence

CVE-2025-3969: Exploit PoC (OS CMD injection, Web Shell, Interactive Shell) (github-poc)
CVE-2025-3969: Exploit PoC (OS CMD injection, Web Shell, Interactive Shell) (github-poc)
CVE-2025-3969: Exploit PoC (OS CMD injection, Web Shell, Interactive Shell) (github-poc)
CVE-2025-3969: Exploit PoC (OS CMD injection, Web Shell, Interactive Shell) (github-poc)
CVE-2025-3969: Exploit PoC (OS CMD injection, Web Shell, Interactive Shell) (github-poc)
CIRCL seen: CVE-2025-3969 (circl-sighting)
CIRCL seen: CVE-2025-3969 (circl-sighting)
VDB-306305 | codeprojects News Publishing Site Dashboard Edit Category Page edit-category.php unrestricted upload (circl)
VDB-306305 | CTI Indicators (IOB, IOC, TTP, IOA) (circl)
Submit #557287 | code-projects.org News Publishing Site Dashboard v1.0 RCE (circl)

…and 1 more exploits

Timeline

Apr 27, 2025 CVE Published
Apr 27, 2025 PoC Published
Apr 27, 2025 PoC Published
Apr 28, 2025 EPSS Score
Apr 28, 2025 CVE Updated
May 10, 2025 EPSS Score
May 22, 2025 EPSS Score
Jun 3, 2025 EPSS Score
Jun 11, 2025 Coalition ESS Score
Jun 15, 2025 EPSS Score
Jun 27, 2025 EPSS Score
Jul 9, 2025 EPSS Score

References

Open in Interactive Console →