CVE-2025-11351: code-projects Online Hotel Reservation System editpicexec.php unrestricted upload

Published Oct 7, 2025

Updated

A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec.php. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

Affected Software

2 affected components

Code-projects Online Hotel Reservation System

Fabian Online Hotel Reservation System=1.0

Event History

Oct 7, 2025

CVE Published

via MITRE·04:32 AM

Data Sourced

via MITRE·04:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11351?

CVE-2025-11351 is classified as a high-severity vulnerability due to the potential for remote exploitation.

How do I fix CVE-2025-11351?

To fix CVE-2025-11351, implement input validation and sanitization to restrict image uploads in the /admin/editpicexec.php file.

What kind of attack can be executed using CVE-2025-11351?

CVE-2025-11351 allows for unrestricted file uploads, which can lead to remote code execution and further exploitation.

Which software is affected by CVE-2025-11351?

CVE-2025-11351 affects the code-projects Online Hotel Reservation System version 1.0.

Is remote exploitation possible with CVE-2025-11351?

Yes, remote exploitation of CVE-2025-11351 is possible due to the vulnerability's unrestricted upload feature.