Is there a public PoC exploit available for CVE-2025-14582?

Yes, a public proof-of-concept exploit is available for CVE-2025-14582. Prioritise patching immediately. EPSS: 0.0%.

campcodes Online Student Enrollment System CVE-2025-14582

Q: What is the CVSS score of CVE-2025-14582?

CVE-2025-14582 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Access Control (CWE-284)

2025-12-12 cna@vuldb.com

PHP Authentication Bypass File Upload Online Student Enrollment System

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:45 vuln.today

DescriptionCVE.org

A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile. Performing a manipulation of the argument userphoto results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Unrestricted file upload in campcodes Online Student Enrollment System 1.0 allows high-privileged authenticated users to upload arbitrary files via the userphoto parameter in /admin/index.php?page=user-profile, potentially enabling remote code execution or data exfiltration. Public exploit code is available, though the vulnerability's real-world impact is limited by the requirement for administrative credentials and low CVSS/EPSS scores.

Technical ContextAI

The vulnerability exists in a PHP-based web application's user profile administration interface. The underlying issue is improper input validation on file upload functionality (CWE-284: Improper Access Control), specifically in how the application handles the userphoto parameter. The attack vector is network-accessible (AV:N) with low complexity (AC:L), but critically requires high-level privileges (PR:H), indicating this is an admin-only flaw. The affected component is the /admin/index.php endpoint with page=user-profile parameter, which lacks sufficient server-side validation and type checking on uploaded files. CPE identifies the affected product as campcodes Online Student Enrollment System version 1.0.

RemediationAI

Vendor patch information is not available from the provided references or campcodes.com documentation. Organizations using campcodes Online Student Enrollment System 1.0 should contact the vendor directly at campcodes.com for a security update addressing CWE-284 validation deficiencies. As interim compensating controls, implement strict file upload validation at the application level by (1) restricting userphoto uploads to authenticated admin users only and validating file type using MIME type checking combined with magic bytes verification (discard files claiming to be images but containing executable code), (2) storing uploaded files outside the web root directory to prevent direct execution, (3) enforcing read-only permissions on the upload directory, and (4) implementing file size limits and disabling script execution in the upload directory via web server configuration (.htaccess for Apache: SetHandler default-handler, or nginx: location ~* \.php { deny all; }). Additionally, restrict access to /admin/index.php to trusted IP ranges using web server access control lists, reducing the attack surface until patching is available.