CVE-2025-13411CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2025-13411

Medium · published November 20, 2025

CVSS v3.1

4.7

EPSS

Percentile

31.4

In the wild

Unconfirmed

What it is

A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_football.php. Performing a manipulation of the argument product_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00386 · 31.4th percentile
Weaknesses: CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-11-20T02:15Z

Affected products (1)

Product	Versions	Fixed in
campcodes/retro_basketball_shoes_online_store	all versions	—

References (5)

https://github.com/laosijivul/cve/issues/2 · [email protected]https://vuldb.com/?ctiid.332938 · [email protected]https://vuldb.com/?id.332938 · [email protected]https://vuldb.com/?submit.693697 · [email protected]https://www.campcodes.com/ · [email protected]

EPSS history

Timeline

19 NOV 20:32Z
Campcodes Retro Basketball Shoes Online Store admin_football.php unrestricted upload
cvelistv5