Is there a public PoC exploit available for CVE-2025-14642?

Yes, a public proof-of-concept exploit is available for CVE-2025-14642. Prioritise patching immediately. EPSS: 0.1%.

Computer Laboratory System CVE-2025-14642

Q: What is the CVSS score of CVE-2025-14642?

CVE-2025-14642 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-12-14 cna@vuldb.com

PHP Authentication Bypass File Upload Computer Laboratory System

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:46 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the file technical_staff_pic.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege users to upload arbitrary files to the server. The vulnerability requires administrator-level access (PR:H) and affects confidentiality, integrity, and availability with low impact scope. Publicly available exploit code exists; however, the EPSS score of 0.07% (21st percentile) and high-privilege requirement significantly limit real-world exploitation risk compared to the CVSS 2.0 baseline.

Technical ContextAI

The vulnerability exists in the technical_staff_pic.php file, a component handling image uploads within the Computer Laboratory System. The underlying issue is classified as CWE-284 (Improper Access Control), indicating that the file upload mechanism lacks proper validation or authorization checks on the image parameter. The application is built with PHP and processes file uploads directly, likely without sufficient server-side validation of file type, extension, or content. An attacker with high-privilege credentials (administrator or technical staff account) can exploit this to upload executable or malicious files that may be accessible and executed by the web server.

RemediationAI

Upgrade to a patched version if available from the vendor; however, no fixed version has been identified in the provided references. As immediate mitigations, restrict administrative access to the Computer Laboratory System to trusted personnel only, enforce strong authentication and multi-factor authentication for administrative accounts, and implement file upload validation at the application level-including file type whitelisting (reject executable extensions), MIME type verification, and storage outside the web root to prevent direct execution. Additionally, disable PHP script execution in the upload directory via web server configuration (e.g., .htaccess or nginx location blocks) to prevent uploaded scripts from executing even if validation is bypassed. Contact code-projects.org directly for patch availability and security advisories.