CVE-2025-15262

BiggiDroid Simple PHP CMS Site Logo edit.php unrestricted upload

CVSS 5.1 MEDIUMEPSS 0.3%CWE-284 CWE-434

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 dic 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

BiggiDroid · Simple PHP CMS

Referencias

https://gitee.com/shanyaohei/black-yam/issues/IDGML9 https://vuldb.com/?ctiid.338656 https://vuldb.com/?id.338656 https://vuldb.com/?submit.725815