Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Path Traversal
Biometric Shift Employee Management System
Iwcnetwork
NVD
GitHub
CVSS 3.0
9.8
EPSS
0.8%