CVE-2025-13423CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2025-13423

Medium · published November 20, 2025

CVSS v3.1

4.7

EPSS

Percentile

29.5

In the wild

Unconfirmed

What it is

A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00368 · 29.5th percentile
Weaknesses: CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-11-20T05:15Z

Affected products (1)

Product	Versions	Fixed in
campcodes/retro_basketball_shoes_online_store	all versions	—

References (6)

https://github.com/Abxery/cveee/issues/6 · [email protected]https://vuldb.com/?ctiid.332945 · [email protected]https://vuldb.com/?id.332945 · [email protected]https://vuldb.com/?submit.696051 · [email protected]https://www.campcodes.com/ · [email protected]https://github.com/Abxery/cveee/issues/6 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 NOV 23:32Z
Campcodes Retro Basketball Shoes Online Store admin_product.php unrestricted upload
cvelistv5