Is there a public PoC exploit available for CVE-2025-12201?

Yes, a public proof-of-concept exploit is available for CVE-2025-12201. Prioritise patching immediately. EPSS: 0.1%.

User-Management-PHP-MYSQL CVE-2025-12201

Q: What is the CVSS score of CVE-2025-12201?

CVE-2025-12201 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-10-27 cna@vuldb.com

PHP Authentication Bypass File Upload User Management Php Mysql

2.0

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:35 vuln.today

DescriptionNVD

A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload in ajayrandhawa User-Management-PHP-MYSQL allows high-privilege attackers to upload arbitrary files via the image parameter in /admin/edit-user.php. Exploitation requires administrator credentials but publicly available exploit code exists. With an EPSS score of 0.06% and no active exploitation confirmed in CISA KEV, real-world risk is minimal despite the remote attack vector.

Technical ContextAI

The User-Management-PHP-MYSQL application is a PHP-based user management system that implements a web interface at /admin/edit-user.php for administrative user editing operations. The vulnerability stems from improper access controls (CWE-284: Improper Access Control) in the file upload handler, which fails to adequately validate or restrict the image parameter. The application appears to use rolling releases without versioning, making it difficult to track patch status. The vulnerability chain involves the admin interface accepting user-supplied input (the image parameter) and processing it without sufficient server-side validation of file type, size, or upload destination.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor did not respond to early disclosure notification. Immediate compensating controls are required: restrict network access to /admin/edit-user.php and the entire /admin directory to trusted internal IP ranges only (trade-off: reduces accessibility but severely limits remote exploitation surface). Implement strict file upload validation on the image parameter, including server-side mime-type verification (not client-side) and file extension whitelisting (trade-off: may reject legitimate uploads if filter is too restrictive). Enforce strong, unique administrator credentials and implement multi-factor authentication for admin panel login (trade-off: increased user friction but eliminates the privilege-escalation attack vector). Consider disabling the user edit feature entirely if image uploads are non-critical. Monitor /admin/edit-user.php for suspicious POST requests with image parameters. GitHub link to reported vulnerability: https://github.com/Lianhaorui/Report/blob/main/FileUpload.docx; additional references: https://vuldb.com/?id.329871, https://vuldb.com/?ctiid.329871.

CVE-2025-12201 vulnerability details – vuln.today

Back