CVE-2025-10447 is a high severity flaw in Campcodes Online Job Finder System 1.0, scored 7.3 by NVD. It allows unrestricted file upload through the picture argument of /eris/applicationform.php. The record lists no fixed version, so restrict access to the affected page, review the code, and check the vendor for a patch.
What's affected
The record names Campcodes Online Job Finder System 1.0. The affected code is in /eris/applicationform.php. The vulnerable input is the picture parameter.
No fixed version appears in the record or in the reference pages I could read. Do not assume a later release is safe. Check the vendor or project page for a patched release, and if none exists, plan on mitigation or replacement. The same product has sibling reports with different entry points: CVE-2025-10444 and CVE-2025-10448. Fixing one endpoint does not fix the others.
The record says the exploit has been published and may be used. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Confirm the product and version first: Campcodes Online Job Finder System 1.0. Applications like this are usually installed by copying source files to a server, so no package manager records them and a dependency scan may not list them. Gold's free in-browser dependency scan still covers the libraries that sit next to them, and your own asset list is the place to find the application itself.
Then look at what is already on the server. Check the folder where uploads are stored for files that are not images, such as scripts with a php extension, and for names you do not recognise. Compare it with the upload history you expect.
Next, check whether that folder is served by the web server and whether scripts there are executed. If uploaded files can be fetched and run, the exposure is serious. Read the handler for picture in /eris/applicationform.php. If it accepts any extension or relies on the browser supplied content type, it is affected.
What to do now
- Find every copy of Campcodes Online Job Finder System 1.0 in your estate.
- Take the pages that accept uploads off the public internet or require authentication.
- Configure the upload folder so scripts do not run there, and store uploads outside the web root where possible.
- Check for a patched release. The record lists no fixed version.
- If you maintain the code, allow only expected extensions and types, rename files to random names, and re encode images so embedded code is dropped.
- Inspect the upload folder for files that should not be there, and if you find any, treat the server as compromised and rebuild it.
Why it matters
This is unrestricted file upload, listed under CWE-284 (improper access control), CWE-434 (unrestricted upload of a dangerous file type). Letting a visitor choose what gets stored on your server is risky when the server will then run or serve it. A script uploaded in place of a picture and fetched through the web server can run with the permissions of the web application.
CWE-284 is also listed because the access checks around the upload do not hold. The same issue appears in CVE-2025-10444 and CVE-2025-10448 through other handlers. The score of 7.3 comes from network reach, low complexity and no privileges required, with low impact ratings in the vector.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is checking the file extension enough?
No. Use an allow list of types, rename the file, store it outside the web root and prevent execution in the upload folder.
What if I find unexpected files?
Treat the server as compromised, preserve logs, rebuild from a clean source and rotate credentials.
Sources
Last reviewed: 19 October 2026.
