What is the CVSS score of CVE-2026-37748?

CVE-2026-37748 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Visitor Management System are affected by CVE-2026-37748?

Visitor Management System 1.0 contains a critical remote code execution vulnerability in administrator file upload functions that allows authenticated admins to deploy malicious PHP code directly to…

How to fix or mitigate CVE-2026-37748?

Within 24 hours: Identify all systems running Visitor Management System 1.0 and document current versions; restrict administrative access to admin_user_insert.php and update_1.php endpoints via network firewall or WAF rules blocking POST/file uploads. Within 7 days: Conduct forensic audit of file upload directories and admin logs for unauthorized PHP files or suspicious administrative activity dating back 90 days; isolate affected systems from production networks if compromise indicators are found. Within 30 days: Contact vendor for patch timeline and ETA; evaluate alternative visitor management solutions if patch unavailability extends beyond 60 days; implement mandatory code review for any custom modifications to upload handlers.

Visitor Management System CVE-2026-37748

EUVD-2026-24139 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-21 mitre

GHSA-3pw2-2fp4-54wm

PHP File Upload RCE

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 16:07 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 19:23 vuln.today

CVSS changed

Apr 21, 2026 - 19:22 NVD

7.2 (None) 7.2 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 16:00 euvd

EUVD-2026-24139

Analysis Generated

Apr 21, 2026 - 16:00 vuln.today

CVE Published

Apr 21, 2026 - 00:00 nvd

HIGH 7.2

DescriptionCVE.org

Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remote Code Execution on the server.

AnalysisAI

Remote code execution in Visitor Management System 1.0 allows authenticated administrators to upload PHP webshells via two unvalidated file upload endpoints (admin_user_insert.php and update_1.php). The move_uploaded_file() function lacks MIME type, extension, and content validation, enabling direct server compromise. Public proof-of-concept exists (SSVC exploitation: POC). EPSS data not available, but the combination of network-accessible attack vector (AV:N) and total technical impact (SSVC) against a specific niche product suggests targeted exploitation risk rather than widespread automated attacks.

Technical ContextAI

This is a classic unrestricted file upload vulnerability (CWE-434) in a PHP-based web application. The Visitor Management System 1.0 by sanjay1313 uses PHP's move_uploaded_file() function in two administrative endpoints without implementing security controls. Standard secure file upload practices require validating file extensions against a whitelist, verifying MIME types (though these can be spoofed), checking magic bytes/file signatures, renaming uploaded files, storing them outside the webroot, and setting restrictive permissions. The absence of these controls allows an attacker with admin credentials to upload executable PHP code that the web server will interpret, granting full command execution under the web server's user context (typically www-data or apache on Linux systems).

RemediationAI

Primary fix: Review the project repository at https://github.com/sanjay1313/Visitor-Management-System for updated code addressing CVE-2026-37748. No vendor-released patch version is confirmed in available data as of this analysis. If no official patch exists, implement immediate code-level mitigations: modify admin_user_insert.php and update_1.php to validate file extensions against a whitelist (e.g., only .jpg, .png, .pdf), verify MIME types using finfo_file() with FILEINFO_MIME_TYPE, check file signatures/magic bytes, store uploads outside the webroot or in a directory with PHP execution disabled via .htaccess (php_flag engine off), and rename uploaded files to prevent direct execution. Compensating controls with trade-offs: restrict admin panel access by IP whitelist (limits remote administration flexibility), enforce multi-factor authentication for all admin accounts (deployment overhead), implement web application firewall rules to block suspicious file upload patterns (potential false positives), enable PHP disable_functions directive to restrict system command execution (may break legitimate application features), and monitor web server logs for POST requests to the vulnerable endpoints followed by requests to uploaded .php files in upload directories (detective not preventive).