CVE-2025-60500 File upload in n/a
Authenticated users can bypass file type restrictions to upload arbitrary PHP files, enabling remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-60500?
CVE-2025-60500 is a high-severity vulnerability in n/a, published on 21 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory.
Weakness: CWE-434
Which versions are affected by CVE-2025-60500?
It affects 1 product.
Products include Qdocs Smart School.
How do I fix CVE-2025-60500?
No fix has been published for CVE-2025-60500 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-60500 being exploited?
There is no known exploitation of CVE-2025-60500 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rh3g-ww52-5mx2.