CVE-2025-69565: code-projects Mobile Shop Management System 1.0 Unrestricted File Upload
CVE-2025-69565 describes a file upload weakness (CWE-434) in the /ExAddProduct.php component of code-projects Mobile Shop Management System 1.0. The record reports a CVSS 3.1 base score of 9.8 and a critical severity rating. No fixed version is listed in the sources consulted, and the vulnerability is not in CISA KEV.
Overview
CVE-2025-69565 is a file upload vulnerability in the /ExAddProduct.php page of code-projects Mobile Shop Management System 1.0. The weakness is classified as CWE-434, Unrestricted Upload of File with Dangerous Type. The CVE record was published on 2026-01-27 and is marked as Analyzed in the NVD source status.
Impact
- The CNA-provided CVSS 3.1 base score is 9.8, with network attack vector, low complexity, no privileges and no user interaction required.
- The vector in the record indicates high impact to confidentiality, integrity and availability if the flaw is exploited.
- Inference: unrestricted upload functions on a web application can allow an attacker to place files that the server may later process, which could lead to code execution depending on server configuration. The record does not confirm this outcome.
Affected products and versions
- The record describes code-projects Mobile Shop Management System version 1.0.
- The structured affected-product field names Fabian Mobile Shop Management System, version 1.0. This name differs from the description and should be verified against the vendor or project source.
- No other affected versions are listed in the record.
Exploitation status
- CISA KEV lists this CVE as not listed in the record, so no confirmed active exploitation is recorded in the KEV data.
- No confirmed exploitation appears in the sources consulted.
- One third-party reference is tagged as Exploit in the record. This indicates that exploit-related material has been linked, but the record does not confirm its accuracy or effectiveness.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not mean no fix exists; the status is unknown.
- Administrators running this application should restrict access to administrative and product management pages, limit who can reach upload functions, and check with the software source for an update or replacement.
- Defensive measures include validating file type and content on the server, storing uploads outside the web root, and removing execute permissions from upload directories.
Detection guidance
- Review web server logs for unexpected POST requests to /ExAddProduct.php and for new files appearing in upload or image directories.
- Monitor for newly created files with script or executable extensions in web-accessible paths.
- Alert on unusual requests to product management endpoints from unfamiliar sources.
Limitations of the available information
- The record does not provide a fixed version, vendor advisory or detailed technical analysis.
- The product name differs between the description and the structured affected field.
- EPSS and SSVC data are not available in the record.
- The contents of the Exploit-tagged reference were not verified for this analysis.
Frequently asked questions
What is CVE-2025-69565?
It is a file upload vulnerability (CWE-434) in the /ExAddProduct.php page of code-projects Mobile Shop Management System 1.0, according to the CVE record.
Is there a fix for this vulnerability?
No fixed version is listed in the record. The status of a fix is unknown, so administrators should check the software source for updates.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE according to the record, and no confirmed exploitation appears in the sources consulted. One reference is tagged as Exploit, but its content was not verified.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.