CVE-2025-13576 code-projects Blog Site admin.php improper authorization
Remote attackers can bypass authorization checks in the admin panel to perform unauthorized actions, requiring immediate attention from site administrators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13576?
CVE-2025-13576 is a medium-severity missing authorization vulnerability in code-projects Blog Site, published on 24 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. Multiple endpoints are affected.
Which versions are affected by CVE-2025-13576?
It affects 1 product.
Products include Fabian Blog Site.
How do I fix CVE-2025-13576?
No fix has been published for CVE-2025-13576 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-13576 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13576 exists.
Other vulnerabilities in code-projects Blog Site
Sources
Also known as GHSA-q2cr-96j4-c73w.