Is there a public PoC exploit available for CVE-2025-15262?

Yes, a public proof-of-concept exploit is available for CVE-2025-15262. Prioritise patching immediately. EPSS: 0.1%.

Simple PHP CMS CVE-2025-15262

Q: What is the CVSS score of CVE-2025-15262?

CVE-2025-15262 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-12-30 cna@vuldb.com

PHP Authentication Bypass File Upload Simple Php Cms Biggidroid

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Admin panel is network-accessible with low complexity (AV:N/AC:L); high-privilege credentials required (PR:H); successful PHP webshell upload changes scope to OS-level RCE (S:C, C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:40 vuln.today

CVE Published

Dec 30, 2025 - 18:15 cve.org

LOW 2.0

DescriptionCVE.org

A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Unrestricted file upload in BiggiDroid Simple PHP CMS 1.0 allows authenticated administrators to upload arbitrary files - including PHP webshells - via the image parameter in the /admin/edit.php Site Logo Handler. A public proof-of-concept is confirmed available via Gitee (tagged 'exploit' by NVD), though the EPSS score of 0.05% at the 17th percentile reflects negligible opportunistic exploitation activity. The CVSS 4.0 base score of 2.0 is almost entirely driven by the PR:H administrative credential requirement, making this primarily an insider-threat or post-credential-compromise scenario rather than a direct unauthenticated remote attack.

Technical ContextAI

The affected component is the Site Logo upload handler located at /admin/edit.php within BiggiDroid Simple PHP CMS version 1.0 (CPE: cpe:2.3:a:biggidroid:simple_php_cms:1.0:*:*:*:*:*:*:*). The root cause is classified as CWE-284 (Improper Access Control), indicating the application fails to enforce proper restrictions on the file type or content accepted by the image parameter during upload. In PHP-based CMS platforms, unrestricted file upload vulnerabilities in admin panels typically allow an attacker to upload a PHP script with an image-mimicking extension or without content-type validation, then access the uploaded file over the web to achieve server-side code execution. Notably, the VulDB submission includes an 'Authentication Bypass' tag alongside this finding, which creates ambiguity about whether a separate access-control flaw could reduce the effective privilege requirement below the PR:H indicated in the CVSS vector - this has not been independently confirmed.

RemediationAI

No vendor-released patch has been identified at time of analysis for BiggiDroid Simple PHP CMS 1.0. As compensating controls, administrators should implement server-side file type validation that inspects MIME type and actual file content (not merely the extension) for all upload endpoints in /admin/edit.php. Web server configuration should deny PHP execution within the uploads directory - via .htaccess php_flag engine off in Apache or a location block disallowing PHP execution in nginx - which prevents uploaded webshells from being executed even if the file is accepted. Restricting access to the /admin/ path via IP allowlisting at the web server or firewall layer limits the attack surface to known management networks. Disabling the Site Logo upload feature entirely eliminates this specific attack surface with minimal functional impact for deployments not using custom logos. Given the niche nature and apparent lack of active maintenance for this product, migration to an actively maintained CMS platform may represent the most durable long-term remediation. Refer to VulDB entry https://vuldb.com/?id.338656 for disclosure details.