CVE-2025-11354
CRITICALCVSS 9.8/10EPSS 0.36%
Last modified
CVE-2025-11354 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. EPSS estimates a 0.36% chance of exploitation in the next 30 days.
Description
A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fabian | Online Hotel Reservation System | 1.0 |
References
- https://code-projects.org/Product
- https://github.com/zhicat/C/issues/31Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.327239Permissions Required, VDB Entry
- https://vuldb.com/?id.327239Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.664924Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-11354?
A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
How severe is CVE-2025-11354?
CVE-2025-11354 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.36% probability of exploitation in the next 30 days.
How do I fix CVE-2025-11354?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-11349A vulnerability was identified in Campcodes Online Apartment…9.8
- CVE-2025-1135A vulnerability exists in ChurchCRM 5.13.0. and prior that a…7.2
- CVE-2025-11350A security flaw has been discovered in Campcodes Online Apar…9.8
- CVE-2025-11351A weakness has been identified in code-projects Online Hotel…8.8
- CVE-2025-11352A security vulnerability has been detected in code-projects …8.8
- CVE-2025-11353A vulnerability was detected in code-projects Online Hotel R…8.8
- CVE-2025-11355A vulnerability has been found in UTT 1250GW up to v2v3.2.2-…8.8
- CVE-2025-11356A vulnerability was found in Tenda AC23 up to 16.03.07.52. A…8.8
- CVE-2025-11357A security flaw has been discovered in code-projects Simple …8.8
- CVE-2025-11358A weakness has been identified in code-projects Simple Banki…8.8
- CVE-2025-11359A security vulnerability has been detected in code-projects …8.8
- CVE-2025-11360A vulnerability was detected in jakowenko double-take up to …5.3
Are you affected by CVE-2025-11354?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST