CVE-2026-37748

Katalog CVE

CVSS 7.2 · High EPSS 0,86%

Kerentanan Unrestricted Upload of File with Dangerous Type pada sanjay1313 visitor management system. Skor CVSS 3.1 7.2 (High) menurut CISA ADP.

Deskripsi (NVD)

Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remote Code Execution on the server.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/menevarad007/CVE-2026-37748 exploit · advisory pihak ketiga
• https://github.com/sanjay1313/Visitor-Management-System product