CVE-2025-46191

Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploaded_file_cancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attackers can upload executable PHP files to a web-accessible directory (/files/). This allows them to execute arbitrary commands remotely by accessing the uploaded script, resulting in full Remote Code Execution (RCE) without authentication.

• CWE-94

• https://github.com/x6vrn/mitre/blob/main/CVE-2025-46191.mdThird Party Advisory
• https://portswigger.net/web-security/file-uploadTechnical Description

Published

May 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46183The Utils.deserialize function in pgCodeKeeper 10.12.0 proce…8.2
• CVE-2025-46185An Insecure Permission vulnerability in pgcodekeeper 10.12.0…6.2
• CVE-2025-46188SourceCodester Client Database Management System 1.0 is vuln…9.8
• CVE-2025-46189SourceCodester Client Database Management System 1.0 is vuln…9.8
• CVE-2025-4619A denial-of-service (DoS) vulnerability in Palo Alto Network…6.6
• CVE-2025-46190SourceCodester Client Database Management System 1.0 is vuln…9.8
• CVE-2025-46192SourceCodester Client Database Management System 1.0 is vuln…9.8
• CVE-2025-46193SourceCodester Client Database Management System 1.0 is vuln…9.8
• CVE-2025-46198Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.4…8.8
• CVE-2025-46199Cross Site Scripting vulnerability in grav v.1.7.48 and befo…9.8
• CVE-2025-46203An issue in Unifiedtransform v2.0 allows a remote attacker t…6.5
• CVE-2025-46204An issue in Unifiedtransform v2.0 allows a remote attacker t…6.5