CVE-2025-10600 is a high severity unrestricted file upload flaw (CVSS 7.3) in SourceCodester Online Exam Form Submission 1.0. The weakness sits in /register.php. The record names no fixed version, so block the endpoint, restrict what the server will accept and execute, and scan your dependencies.
What's affected
The record lists SourceCodester Online Exam Form Submission 1.0. The affected file is /register.php, and the vulnerable input is img.
No fixed version appears in the record. I could not confirm a patched release from the sources available, so check the SourceCodester site and the referenced report before assuming a fix exists. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no user interaction, and no privileges required.
How to check if you're exposed
First confirm the application is installed and the upload script exists. Then look at what the script does with the uploaded file:
find /var/www -name "register.php" 2>/dev/null
grep -n "move_uploaded_file" $(find /var/www -name "register.php")
Also list the upload directory and look for files that are not images or documents, such as scripts. Review web server access logs for requests to the endpoint from addresses you do not recognize.
You can also paste your dependency manifest into the free in-browser scan at gold.safeguard.sh/scan. It will not find an application like this one if you installed it as a standalone folder, so inventory it by hand.
What to do now
- Disable or restrict
/register.phpuntil the upload handling is corrected. - Accept only an allowlist of file types, check the content and not just the extension, and rename files on save.
- Store uploads outside the web root, or configure the upload folder so the server never executes files from it.
- Review the upload folder for unexpected files and remove them after preserving copies for analysis.
- Check the vendor site and referenced report for a patch, and apply it if one exists.
Why it matters
This is CWE-434, unrestricted upload of a file with a dangerous type, together with CWE-284, improper access control. When a server accepts any file and stores it somewhere it can be fetched or run, the upload feature becomes a way to place code on the host.
The usual defenses are an allowlist of types, content checks, storing files outside the web root and denying execution in upload folders. The record does not flag this CVE as a CISA Known Exploited Vulnerability, so there is no confirmation here that it is exploited in the wild.
The record says the exploit has been made public. That describes published detail, not observed attacks.
Quick check
Is there a fixed version of Online Exam Form Submission?
The record lists none. Check the SourceCodester site and the referenced report. Until then, restrict the endpoint and fix the code yourself.
Is this being exploited in the wild?
The record does not flag it as a CISA KEV entry. It does say the exploit has been published, so assume attackers can reproduce it.
Sources
- Safeguard Gold entry for CVE-2025-10600
- NVD record for the CVE, as supplied in the Safeguard CVE feed
- The links below come from that record. Several could not be opened when this post was reviewed, so confirm details with the vendor.
- https://github.com/qcycop0101-hash/CVE/issues/18
- https://www.sourcecodester.com/
- https://vuldb.com/?ctiid.324620
- https://vuldb.com/?id.324620
Last reviewed: 19 October 2026.
