EUVD-2026-34865
GHSA-wr5j-g224-7wj3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.
AnalysisAI
Unrestricted file upload in code-projects Vehicle Management System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo parameter of the New Driver Registration Form (newdriver.php), enabling remote code execution. Publicly available exploit code exists on GitHub, increasing the likelihood of opportunistic abuse against exposed instances despite no CISA KEV listing.
Technical ContextAI
The affected application is a PHP-based vehicle fleet management web app distributed by code-projects.org, identified by CPE cpe:2.3:a:code-projects:vehicle_management_system. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the newdriver.php endpoint accepts the photo form field without validating MIME type, file extension, or content, allowing an attacker to upload a PHP script to a web-accessible directory and request it to execute arbitrary code under the web server user.
RemediationAI
No vendor-released patch identified at time of analysis. Operators should remove or restrict access to newdriver.php until a fix is available, and in the interim modify the upload handler to enforce a strict allowlist of image extensions (jpg, jpeg, png, gif), validate MIME type via getimagesize() or finfo, rename uploaded files to non-executable names, and store them outside the web root or in a directory configured to disallow PHP execution (for example with an .htaccess containing 'php_flag engine off' or an nginx location block stripping PHP handling); the trade-off is that legitimate driver registrations may break until the form is rewritten. As a compensating control, place the application behind authentication or a WAF rule blocking multipart uploads to newdriver.php from untrusted networks, accepting that this disables the driver registration workflow. Monitor VulDB (https://vuldb.com/vuln/368884) and https://code-projects.org/ for an official fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today