Is there a public PoC exploit available for CVE-2025-14885?

Yes, a public proof-of-concept exploit is available for CVE-2025-14885. Prioritise patching immediately. EPSS: 0.1%.

SourceCodester Client Database Management System CVE-2025-14885

Q: What is the CVSS score of CVE-2025-14885?

CVE-2025-14885 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-12-18 cna@vuldb.com

PHP Authentication Bypass File Upload Client Database Management System

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:38 vuln.today

DescriptionCVE.org

A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads Generation Module. Executing manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.

AnalysisAI

Unrestricted file upload in SourceCodester Client Database Management System 1.0 via the /user_leads.php endpoint in the Leads Generation Module allows authenticated remote attackers to upload arbitrary files. The vulnerability requires valid user credentials (PR:L in CVSS v4.0) but carries low confidentiality, integrity, and availability impact per the vector. Public exploit code exists, and EPSS score of 0.06% suggests minimal real-world exploitation despite public availability, likely due to the authenticated requirement limiting attack surface.

Technical ContextAI

The vulnerability resides in the Leads Generation Module component, specifically the /user_leads.php file which handles user input for lead management operations. The root cause is classified under CWE-284 (Improper Access Control), indicating insufficient validation or authorization checks on file upload operations. The PHP-based application fails to properly restrict file types, sizes, or destinations for uploaded content when processing lead data, allowing attackers with valid credentials to bypass intended upload restrictions and place malicious files on the server.

RemediationAI

No vendor-released patch is documented in the available references. Immediate mitigation requires restricting access to the /user_leads.php endpoint via web application firewall or reverse proxy rules to permit only trusted IP ranges. Disable or restrict the Leads Generation Module functionality if not actively used. Implement strict file upload validation: whitelist allowed file types (e.g., CSV, PDF only), enforce maximum file size limits, store uploaded files outside the web root directory, and rename uploaded files to remove user-controlled extensions. Apply principle of least privilege by reviewing user authentication to ensure only authorized staff have access to lead upload features. Monitor /user_leads.php access logs for suspicious upload attempts. Until official patch availability is confirmed from SourceCodester, these compensating controls reduce exploitability; the trade-off is operational overhead for upload feature management and potential denial of service if overly restrictive.