{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-7124","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-07-06T08:18:48.709Z","datePublished":"2025-07-07T10:32:05.464Z","dateUpdated":"2025-07-07T12:03:59.085Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-07-07T10:32:05.464Z"},"title":"code-projects Online Note Sharing Profile Image userprofile.php unrestricted upload","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-434","lang":"en","description":"Unrestricted Upload"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-284","lang":"en","description":"Improper Access Controls"}]}],"affected":[{"vendor":"code-projects","product":"Online Note Sharing","versions":[{"version":"1.0","status":"affected"}],"modules":["Profile Image Handler"]}],"descriptions":[{"lang":"en","value":"A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in code-projects Online Note Sharing 1.0 entdeckt. Hiervon betroffen ist ein unbekannter Codeblock der Datei /dashboard/userprofile.php der Komponente Profile Image Handler. Durch das Manipulieren des Arguments image mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"timeline":[{"time":"2025-07-06T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-07-06T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-07-06T10:23:55.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"woziziiziz (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.315036","name":"VDB-315036 | code-projects Online Note Sharing Profile Image userprofile.php unrestricted upload","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.315036","name":"VDB-315036 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.605925","name":"Submit #605925 | code-projects online-notes-sharing 1 Arbitrary File Upload","tags":["third-party-advisory"]},{"url":"https://github.com/yihaofuweng/cve/issues/2","tags":["exploit","issue-tracking"]},{"url":"https://code-projects.org/","tags":["product"]}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-07T12:03:43.012580Z","id":"CVE-2025-7124","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-07-07T12:03:59.085Z"}}]}}