Is there a public PoC exploit available for CVE-2025-14530?

Yes, a public proof-of-concept exploit is available for CVE-2025-14530. Prioritise patching immediately. EPSS: 0.1%.

Real Estate Property Listing App CVE-2025-14530

Q: What is the CVSS score of CVE-2025-14530?

CVE-2025-14530 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-12-11 cna@vuldb.com

PHP Authentication Bypass File Upload Real Estate Property Listing App

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:45 vuln.today

DescriptionCVE.org

A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unrestricted file upload in SourceCodester Real Estate Property Listing App 1.0 allows high-privileged authenticated users to upload arbitrary files via the image parameter in /admin/property.php, potentially leading to remote code execution. The vulnerability affects only administrators or high-privilege accounts due to PR:H requirements, but public exploit code exists and EPSS scoring indicates low real-world exploitation probability (0.07th percentile).

Technical ContextAI

The vulnerability resides in the /admin/property.php endpoint of the Real Estate Property Listing App, a PHP-based web application for property management. The file upload mechanism fails to validate or restrict the file type of image uploads, instead accepting any file type submitted via the image parameter. This is a classic CWE-284 (Improper Access Control) vulnerability where the application trusts user input without proper validation. The flaw allows authenticated administrative users to bypass intended file type restrictions by submitting malicious files (e.g., PHP shells, executables) that the web server may then execute if placed in a web-accessible directory. The vulnerability is amplified in PHP environments where uploaded files with executable extensions (.php, .phtml, .php5) in predictable locations can lead to arbitrary code execution.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate remediation requires: (1) if using version 1.0, contact SourceCodester (www.sourcecodester.com) for patch availability or a security update; (2) as a temporary compensating control, restrict direct web access to the /admin/property.php endpoint using a Web Application Firewall (WAF) rule or web server configuration to block requests containing the image parameter, accepting the trade-off that legitimate admin property uploads will be disabled until a patch is deployed; (3) restrict the /admin/ directory to specific IP ranges or require VPN access to reduce attack surface; (4) ensure uploaded files are stored outside the web root or in a directory with disabled script execution (via .htaccess or web server configuration); (5) implement strict file type validation and rename uploaded files to remove extensions, verifying content MIME type server-side. These controls do not fully remediate the vulnerability and should be considered temporary until a patch is released.