CVE-2025-14583 is a high severity unrestricted file upload (CVSS 7.3) in Campcodes Online Student Enrollment System version 1.0. The CVE record says the exploit is public. No fixed version is confirmed, so the safe course is to take it off the internet, restrict access and fix the input handling.
What's affected
The record lists Campcodes Online Student Enrollment System, version 1.0.
The weak spot is the file /admin/register.php, through the argument photo. The record calls the function unknown, which means the advisory does not give a precise code line. That is typical for reports on this kind of small PHP project.
The record does not list a fixed version. The vendor site and the linked reports should be checked for any update, and until one is confirmed you should treat version 1.0 as unpatched.
How to check if you're exposed
This is application source you deploy yourself, so there is no package manager entry to query. Work from the files.
First confirm you run the product and version in the record. Look in the project folder for a readme, a version note or the download page you used. Then search the code for the affected file and the argument.
grep -rn "register.php" /var/www/
Swap the path for your web root. If the file exists and handles the photo value as the record describes, you match the description. Next, check your web server logs for requests to that file that you do not recognize.
grep "register.php" /var/log/nginx/access.log | tail -n 50
Use your own log path. Also list the upload folder for files that are not images, such as scripts, and for names you do not recognize. You can also run the free in-browser dependency scan on any package manifests that ship with the project.
What to do now
- Find every copy of Online Student Enrollment System you or your team run, including test and demo servers.
- Take the application off the public internet, or put it behind a VPN or an IP allowlist, until you can fix it.
- Change the upload handler so it checks file type by content, stores files outside the web root and never lets an uploaded file run as a script.
- Check logs and the database for signs of use, and rotate any passwords stored by the application.
- Watch the vendor site and the linked reports for a patch, and re-scan once you change the code.
Why it matters
An upload handler decides what kind of file it accepts, where it stores it and whether it can be run. Here the record says the handling of photo lets someone upload a file that should be refused. The weakness is CWE-284 (improper access control), CWE-434 (unrestricted file upload).
The usual danger is that an uploaded script ends up in a folder the web server executes, which turns a file upload into code running on the server. The advisory does not describe that step for this product, so treat it as the general risk of the class and not a confirmed result here.
The CVE is not on the CISA Known Exploited Vulnerabilities list. The record says a public exploit exists, so patch and contain without waiting for confirmation of attacks.
Quick check
Is checking the file extension enough?
No. Check the file type by content, store uploads outside the web root, rename them on save and make sure the upload folder cannot execute scripts.
Does this CVE appear in the CISA KEV list?
No. The record marks it as not in the Known Exploited Vulnerabilities catalog. It does say a public exploit exists, so treat it as a real risk anyway.
Sources
- Safeguard Gold entry for CVE-2025-14583
- github.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
This post is based on the CVE record (published 2025-12-12, source cna@vuldb.com). The reference pages above are the ones the record lists. Check them for any later changes.
Last reviewed: 19 October 2026.
