CVE-2025-15262 BiggiDroid Simple PHP CMS Site Logo edit.php unrestricted upload
Attackers can upload malicious files via the Site Logo handler in BiggiDroid Simple PHP CMS, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15262?
CVE-2025-15262 is a medium-severity vulnerability in BiggiDroid Simple PHP CMS, published on 30 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Which versions are affected by CVE-2025-15262?
It affects 1 product.
Products include Biggidroid Simple Php Cms.
How do I fix CVE-2025-15262?
No fix has been published for CVE-2025-15262 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-15262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15262 exists.
Other vulnerabilities in BiggiDroid Simple PHP CMS
Sources
Also known as GHSA-pc98-fxf5-853j.