CVE-2025-60500
Last modified
CVE-2025-60500 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory.. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qdocs | Smart School | 7.1.0 |
References
- https://github.com/H4zaz/CVE-2025-60500Exploit, Mitigation, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-60500?
How severe is CVE-2025-60500?
How do I fix CVE-2025-60500?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-60481A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 func…5.5
- CVE-2025-60483A NULL pointer dereference in the gf_ac4_pres_b_4_back_chann…5.5
- CVE-2025-60485A segmentation violation in the gf_isom_apple_set_tag_ex fun…5.5
- CVE-2025-60486A heap use-after-free in the dasher_process function (/filte…5.5
- CVE-2025-60495A segmentation violation in the gf_media_get_color_info func…5.5
- CVE-2025-6050Mezzanine CMS, in versions prior to 6.1.1, contains a Stored…4.8
- CVE-2025-60503A cross-site scripting (XSS) vulnerability exists in the adm…8.7
- CVE-2025-60506Moodle PDF Annotator plugin v1.5 release 9 allows stored cro…5.4
- CVE-2025-60507Cross site scripting vulnerability in Moodle GeniAI plugin (…8.9
- CVE-2025-6051A Regular Expression Denial of Service (ReDoS) vulnerability…5.3
- CVE-2025-60511Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers f…4.3
- CVE-2025-60514Tillywork v0.1.3 and below is vulnerable to SQL Injection in…6.5
Are you affected by CVE-2025-60500?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST