CVE-2025-7175— code-projects E-Commerce Site users_photo.php unrestricted upload
Quick assessment
Affected
code-projects E-Commerce Site
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Code-Projects E-Commerce Site是Code-Projects开源的一个电子商务网站。 code-projects E-Commerce Site 1.0版本存在代码问题漏洞，该漏洞源于文件/admin/users_photo.php中参数photo操作不当，可能导致任意文件上传。
Possible ATT&CK Techniques 1 AI
T1505.003 · Web Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-7175
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
code-projects E-Commerce Site users_photo.php unrestricted upload
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in code-projects E-Commerce Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
Code-Projects E-Commerce Site 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Code-Projects E-Commerce Site是Code-Projects开源的一个电子商务网站。 code-projects E-Commerce Site 1.0版本存在代码问题漏洞，该漏洞源于文件/admin/users_photo.php中参数photo操作不当，可能导致任意文件上传。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| code-projects | E-Commerce Site | 1.0 | - |
|
II. Public POCs for CVE-2025-7175
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-7175
请登录查看更多情报信息。
Other References for CVE-2025-7175 (1)
Same Patch Batch · code-projects · 2025-07-08 · 27 CVEs total
| CVE-2025-7180 | 7.3 HIGH | code-projects Staff Audit System login.php sql injection |
| CVE-2025-7157 | 7.3 HIGH | code-projects Online Note Sharing login.php sql injection |
| CVE-2025-7168 | 7.3 HIGH | code-projects Crime Reporting System userlogin.php sql injection |
| CVE-2025-7169 | 7.3 HIGH | code-projects Crime Reporting System complainer_page.php sql injection |
| CVE-2025-7170 | 7.3 HIGH | code-projects Crime Reporting System registration.php sql injection |
| CVE-2025-7171 | 7.3 HIGH | code-projects Crime Reporting System policelogin.php sql injection |
| CVE-2025-7172 | 7.3 HIGH | code-projects Crime Reporting System headlogin.php sql injection |
| CVE-2025-7173 | 7.3 HIGH | code-projects Library System add-student.php sql injection |
| CVE-2025-7174 | 7.3 HIGH | code-projects Library System teacher-issue-book.php sql injection |
| CVE-2025-7178 | 7.3 HIGH | code-projects Food Distributor Site login.php sql injection |
| CVE-2025-7179 | 7.3 HIGH | code-projects Library System add-teacher.php sql injection |
| CVE-2025-7199 | 7.3 HIGH | code-projects Library System notapprove.php sql injection |
| CVE-2025-7184 | 7.3 HIGH | code-projects Library System books.php sql injection |
| CVE-2025-7185 | 7.3 HIGH | code-projects Library System approve.php sql injection |
| CVE-2025-7191 | 7.3 HIGH | code-projects Student Enrollment System login.php sql injection |
| CVE-2025-7196 | 7.3 HIGH | code-projects Jonnys Liquor browse.php sql injection |
| CVE-2025-7197 | 7.3 HIGH | code-projects Jonnys Liquor delete-row.php sql injection |
| CVE-2025-7198 | 7.3 HIGH | code-projects Jonnys Liquor admin-area.php sql injection |
| CVE-2025-7181 | 6.3 MEDIUM | code-projects Staff Audit System test.php unrestricted upload |
| CVE-2025-7186 | 6.3 MEDIUM | code-projects Chat System fetch_chat.php sql injection |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: E-Commerce Site
-
CVE-2026-4613
SourceCodester E-Commerce Site products.php sql injection -
CVE-2025-7756
code-projects E-Commerce Site cross-site request forgery -
CVE-2024-12794
Codezips E-Commerce Site editorder.php sql injection -
CVE-2024-12792
Codezips E-Commerce Site newadmin.php sql injection -
CVE-2024-12791
Codezips E-Commerce Site signin.php sql injection
Same vendor: code-projects
-
CVE-2026-101105
code-projects Matrimonial System Profile Creation Endpoint c -
CVE-2026-93980
code-projects Internship Management System Admin Login Form -
CVE-2026-93979
code-projects Internship Management System login.php sql inj -
CVE-2026-93978
code-projects Internship Management System login.php sql inj -
CVE-2026-93977
code-projects Assessment Management add-single-mark.php cros
Same weakness: CWE-434
-
CVE-2026-92820
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbit -
CVE-2026-64949
Unrestricted File Upload Leading to Remote Code Execution in -
CVE-2026-64947
CSRF Bypass Leading to Remote Code Execution via Unrestricte -
CVE-2026-103541
formtools.org Form Tools Ajax actions.php uploadFile unrestr -
CVE-2026-76144
Genians, Inc Genian SSL PNS Unrestricted File Upload
V. Comments for CVE-2025-7175
No comments yet