CVE-2025-11508CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2025-11508

Medium · published October 9, 2025

CVSS v3.1

4.7

EPSS

Percentile

37.7

In the wild

Unconfirmed

What it is

A security vulnerability has been detected in code-projects Voting System 1.0. This affects an unknown function of the file /admin/voters_add.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00445 · 37.7th percentile
Weaknesses: CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-10-09T03:15Z

Affected products (1)

Product	Versions	Fixed in
fabian/voting_system	all versions	—

References (6)

https://code-projects.org/ · [email protected]https://github.com/underatted/CVE/issues/13 · [email protected]https://vuldb.com/?ctiid.327633 · [email protected]https://vuldb.com/?id.327633 · [email protected]https://vuldb.com/?submit.669458 · [email protected]https://github.com/underatted/CVE/issues/13 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

08 OCT 22:32Z
code-projects Voting System voters_add.php unrestricted upload
cvelistv5