← back
CVE-2025-15495

BiggiDroid Simple PHP CMS editsite.php unrestricted upload

CVSS 5.1 MEDIUMEPSS 0.4%CWE-284CWE-434
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.1EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
09 Jan 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
BiggiDroid · Simple PHP CMS
References
https://gitee.com/hdert/ck/issues/IDGO28https://github.com/Asim-QAZi/RCE-Simplephpblog-biggiedroidhttps://vuldb.com/?ctiid.340273https://vuldb.com/?id.340273https://vuldb.com/?submit.725890https://vuldb.com/?submit.726040