Is there a public PoC exploit available for CVE-2025-7175?

Yes, a public proof-of-concept exploit is available for CVE-2025-7175. Prioritise patching immediately. EPSS: 0.1%.

E-Commerce Site CVE-2025-7175

Q: What is the CVSS score of CVE-2025-7175?

CVE-2025-7175 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-20423 LOW

Improper Access Control (CWE-284)

2025-07-08 cna@vuldb.com

PHP Authentication Bypass File Upload E Commerce Site Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Uploaded file execution leads to full system compromise, justifying high CIA impact and low complexity.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20423

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jul 08, 2025 - 11:15 nvd

MEDIUM 6.3

CVE Published

Jul 08, 2025 - 11:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was found in code-projects E-Commerce Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unrestricted file upload in code-projects E-Commerce Site 1.0 allows authenticated attackers to upload arbitrary PHP files via the photo parameter in /admin/users_photo.php, potentially leading to remote code execution on the server. Public exploit code is available, increasing immediate risk for instances where the admin panel is exposed.

Technical ContextAI

The vulnerability lies in the file upload functionality of the admin panel, specifically in the script /admin/users_photo.php. The root cause is CWE-284 (Improper Access Control), meaning the upload mechanism fails to restrict the types of files that can be uploaded, allowing arbitrary file types including PHP scripts. The affected product is E-Commerce Site version 1.0, as identified by CPE cpe:2.3:a:fabian:e-commerce_site:1.0. The application is PHP-based, so any uploaded PHP file can be executed by the web server if stored in a web-accessible directory.

RemediationAI

No vendor-supplied patch is available. As a workaround, disable the /admin/users_photo.php page or restrict access to authorized IP addresses only. Implement strict file type validation by checking MIME types and file extensions (e.g., allow only image/jpeg, image/png) and rename uploaded files to non-executable extensions. Additionally, configure the web server to prevent PHP execution in the upload directory (e.g., via .htaccess or equivalent). Note that these mitigations may break legitimate admin functionality if not tested thoroughly.