CVE-2025-5840

CWE-284 — Improper Access Control CWE-434 — Unrestricted File Upload3 documents3 sources

Severity

6.9MEDIUM

EPSS

0.3%

top 45.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Sourcecodester Client Database Management System Lerouxyxchire Client Database Management System

Timeline

PublishedJun 7

Description

A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_update_customer_order.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to initiate the attack remotely.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5sourcecodester/client_database_management_system1.0

▶NVDlerouxyxchire/client_database_management_system1.0

🔴Vulnerability Details

GHSA

GHSA-4p69-rxmq-26c6: A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1↗2025-06-07

▶

CVEList

SourceCodester Client Database Management System user_update_customer_order.php unrestricted upload↗2025-06-07

▶