CVE-2025-14219CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2025-14219

Medium · published December 8, 2025

CVSS v3.1

4.7

EPSS

Percentile

26.1

In the wild

Unconfirmed

What it is

A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_running.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00339 · 26.1th percentile
Weaknesses: CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-12-08T11:15Z

Affected products (1)

Product	Versions	Fixed in
campcodes/retro_basketball_shoes_online_store	all versions	—

References (6)

https://github.com/yyue02/cve/issues/1 · [email protected]https://vuldb.com/?ctiid.334661 · [email protected]https://vuldb.com/?id.334661 · [email protected]https://vuldb.com/?submit.701209 · [email protected]https://www.campcodes.com/ · [email protected]https://github.com/yyue02/cve/issues/1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

08 DEC 06:02Z
Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload
cvelistv5