CVE-2025-3765

A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument Avatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

• CWE-284
• CWE-434
• CWE-434

• https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_edit-photo.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.305399Permissions Required, VDB Entry
• https://vuldb.com/?id.305399Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.553722Third Party Advisory, VDB Entry
• https://www.sourcecodester.com/Product

Published

Apr 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3759Endpoint /cgi-bin-igd/netcore_set.cgi which is used for chan…8.7
• CVE-2025-3760A stored cross-site scripting (XSS) vulnerability exists wit…5.4
• CVE-2025-3761The My Tickets – Accessible Event Ticketing plugin for WordP…8.8
• CVE-2025-3762A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-3763A vulnerability classified as critical has been found in Sou…7.8
• CVE-2025-3764A vulnerability classified as critical was found in SourceCo…8.8
• CVE-2025-3766The Login Lockdown & Protection plugin for WordPress is vuln…5.4
• CVE-2025-3767Improper Neutralization of Special Elements used in an SQL C…7.2
• CVE-2025-3768Improper access control in Tor network blocking feature in D…5
• CVE-2025-3769The LatePoint – Calendar Booking Plugin for Appointments and…5.3
• CVE-2025-3770EDK2 contains a vulnerability in BIOS where an attacker may …7
• CVE-2025-3771A path or symbolic link manipulation vulnerability in SIR 1.…7.1