CVE-2025-11354: code-projects Online Hotel Reservation System addslideexec.php unrestricted upload

Published Oct 7, 2025

Updated

A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.

Affected Software

2 affected components

Code-projects Online Hotel Reservation System

Fabian Online Hotel Reservation System=1.0

Event History

Oct 7, 2025

CVE Published

via MITRE·06:02 AM

Data Sourced

via MITRE·06:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11354?

CVE-2025-11354 is classified as a critical vulnerability due to the potential for unrestricted file uploads.

How do I fix CVE-2025-11354?

To fix CVE-2025-11354, ensure that proper validation and restrictions are implemented for file uploads in the /admin/addslideexec.php file.

What impact does CVE-2025-11354 have on my system?

CVE-2025-11354 can allow an attacker to upload malicious files that may be executed on the server, leading to a system compromise.

Is my version of the Online Hotel Reservation System affected by CVE-2025-11354?

Yes, CVE-2025-11354 affects all versions of the code-projects Online Hotel Reservation System, particularly version 1.0.

Can CVE-2025-11354 be exploited remotely?

Yes, CVE-2025-11354 can be exploited remotely as the vulnerability allows for manipulation of arguments from outside the system.