CVE-2025-12953: 
WordPress Analyse et atténuation des vulnérabilités

A critical vulnerability (CVE-2024-12953) was discovered in the 1000 Projects Portfolio Management System MCA version 1.0. The vulnerability was initially reported on December 26, 2024, and last modified on April 22, 2025. The issue affects the /updatepdprocess.php file functionality, allowing for unrestricted file upload capabilities (NVD).

The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). The attack vector is network-accessible with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability allows for remote exploitation and can lead to significant security implications through unrestricted file upload capabilities. The high severity scores across confidentiality, integrity, and availability (C:H/I:H/A:H) indicate potential complete compromise of the affected system (NVD).

The affected software is version 1.0 of the Portfolio Management System MCA. Users are advised to implement strict file upload controls and monitor for unauthorized file uploads until a patch is available (NVD).