CVE-2025-14530CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2025-14530

Medium · published December 11, 2025

CVSS v3.1
4.7
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-12-11T23:16Z
Affected products (1)
ProductVersionsFixed in
remyandrade/real_estate_property_listing_appall versions—
References (6)
https://github.com/zzdzz7/cve/issues/2 · [email protected]https://vuldb.com/?ctiid.335871 · [email protected]https://vuldb.com/?id.335871 · [email protected]https://vuldb.com/?submit.703238 · [email protected]https://www.sourcecodester.com/ · [email protected]https://github.com/zzdzz7/cve/issues/2 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 DEC 17:32Z
    SourceCodester Real Estate Property Listing App property.php unrestricted upload
    cvelistv5