CVE-2025-3855

MEDIUM

CodeCanyon RISE Ultimate Project Manager 3.8.2 - Improper Control o...

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-3855. PoCs published by L4zyFox.

AI-analyzed exploit summary This repository documents an IDOR vulnerability (CVE-2025-3855) in RISE Ultimate Project Manager & CRM version 3.8.2, where authenticated users can change the profile picture of any other user by manipulating the user ID in the endpoint URL.

Description

A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php/team_members/save_profile_image/ of the component Profile Picture Handler. The manipulation of the argument profile_image_file leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Exploits (1)

nomisec WRITEUP
by L4zyFox · poc
https://github.com/L4zyFox/RISE-Ultimate_Project_Manager_e_CRM

This repository documents an IDOR vulnerability (CVE-2025-3855) in RISE Ultimate Project Manager & CRM version 3.8.2, where authenticated users can change the profile picture of any other user by manipulating the user ID in the endpoint URL.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: RISE - Ultimate Project Manager & CRM 3.8.2
Auth required
Prerequisites: Authenticated access to the application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.305780
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.305780
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.556871

Scores

CVSS v3 4.3
EPSS 0.0036
EPSS Percentile 27.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-99
Status published
Products (1)
fairsketch/rise_ultimate_project_manager 3.8.2
Published Apr 22, 2025
Tracked Since Feb 18, 2026