Is there a public PoC exploit available for CVE-2025-11426?

Yes, a public proof-of-concept exploit is available for CVE-2025-11426. Prioritise patching immediately. EPSS: 0.0%.

Advanced Library Management System CVE-2025-11426

Q: What is the CVSS score of CVE-2025-11426?

CVE-2025-11426 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Access Control (CWE-284)

2025-10-08 cna@vuldb.com

PHP Authentication Bypass File Upload Advanced Library Management System Projectworlds

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:02 vuln.today

DescriptionCVE.org

A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_book.php. The manipulation of the argument image results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.

Technical ContextAI

The vulnerability exists in the /edit_book.php endpoint of a PHP-based library management application. The image parameter fails to properly validate or restrict uploaded file types, allowing authenticated users to bypass intended file upload controls. CWE-284 (Improper Access Control) indicates the root cause involves insufficient enforcement of authorization checks on file upload operations. The attack leverages HTTP protocol over the network, requiring only low-complexity manipulation of a single parameter.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate remediation requires upgrading to a patched version if available from projectworlds, or applying vendor security update documentation from vuldb.com. As compensating controls, restrict access to /edit_book.php to trusted internal networks only via web application firewall or reverse proxy rules, implement file type whitelisting at the application level to reject non-image uploads, enforce Content-Type validation server-side, disable PHP execution in upload directories via web server configuration (e.g., Apache .htaccess or nginx location blocks), and implement strict file extension checking beyond MIME type validation. Monitor file uploads for suspicious activity and regularly audit uploaded file integrity. These controls mitigate impact but do not fully remediate the underlying validation flaw.