Description
code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor files when modifying personal avatar information and use web shell connection tools to obtain server permissions.
Affected products
carmelo: computer laboratory system
References2
- github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56295.md ExploitThird Party Advisory
- github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56295.md ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
7.3
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - EPSS — exploit probability
- 0% percentile: 26 · as of 8 November 2026
- CWE
- CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.