CVE-2025-14195 code-projects Employee Profile Management System add_file_query.php unrestricted upload
Remote attackers can upload arbitrary files via the add_file_query.php script, potentially leading to code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14195?
CVE-2025-14195 is a medium-severity vulnerability in code-projects Employee Profile Management System, published on 7 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_query.php. The manipulation of the argument per_file results in unrestricted upload. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Which versions are affected by CVE-2025-14195?
It affects 1 product.
Products include Carmelogarcia Employee Profile Management System.
How do I fix CVE-2025-14195?
No fix has been published for CVE-2025-14195 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14195 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14195 exists.
Other vulnerabilities in code-projects Employee Profile Management System
- CVE-2025-14222 code-projects Employee Profile Management System print_personnel_report.php sql injection
- CVE-2025-14193 code-projects Employee Profile Management System view_personnel.php sql injection
- CVE-2025-14194 code-projects Employee Profile Management System view_personnel.php cross site scripting
- CVE-2024-0467 code-projects Employee Profile Management System edit_position_query.php cross site scripting
Sources
Also known as GHSA-wmr8-wvmc-3q52.