What is the CVSS score of CVE-2026-4875?

CVE-2026-4875 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-4875?

Yes, a public proof-of-concept exploit is available for CVE-2026-4875. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4875?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Free Hotel Reservation System CVE-2026-4875

EUVD-2026-16169 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-26 VulDB

PHP File Upload Free Hotel Reservation System Itsourcecode

2.0

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-434 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V5 - File Handling File type validation, storage isolation MITRE ATT&CK 2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates a remotely exploitable vulnerability with low attack complexity but requiring high privileges, suggesting this is primarily a post-authentication or privilege escalation risk. The EPSS score is not provided in available intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing is indicated, meaning no confirmation of active exploitation in the wild. However, publicly available exploit code exists (referenced via GitHub: bybinyu/Vulnerability-Practice/issues/4), elevating real-world risk above the nominal CVSS score. The vulnerability is automatable and requires no user interaction, but the PR:H (high privilege requirement) constraint significantly reduces attack surface-only high-privileged admin accounts or compromised admin sessions pose direct risk. This is a contained but real threat suitable for patching before internal compromise scenarios, rather than an urgent perimeter defense priority.
Exploit ScenarioDerived	A compromised or malicious administrator logs into the hotel reservation system and navigates to /admin/mod_amenities/index.php?view=add. Instead of uploading a legitimate image, the attacker uploads a PHP webshell disguised with an image extension (e.g., shell.php.jpg or shell.phtml) via the image parameter. The server fails to validate the file type and stores it in a web-accessible directory. The attacker then accesses the uploaded shell directly via HTTP, gaining remote code execution with the privileges of the web server process. Publicly available proof-of-concept code (referenced in GitHub) demonstrates this workflow, making the attack trivial to execute for any authenticated administrator.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Free Hotel Reservation System 1.0 permits unrestricted file uploads via the image parameter in the /admin/mod_amenities/index.php?view=add endpoint, allowing remote attackers with high privileges to upload arbitrary files. The vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects the amenities management module and has publicly available exploit code. With a CVSS v4.0 score of 5.1 and network-accessible attack vector requiring high administrative privileges, this poses a moderate risk primarily to authenticated administrators or systems where authentication has been compromised.

RemediationAI

Upgrade Free Hotel Reservation System to a patched version released by itsourcecode (exact patched version not specified in available advisories; consult vendor directly or check https://itsourcecode.com/ for release notes). Until patching is possible, implement strict file upload controls: enforce server-side whitelist validation limited to safe image types (JPEG, PNG, WebP), verify MIME types independently of file extensions, store uploaded files outside the web root or in a non-executable directory (configure via .htaccess or server directives to disable PHP execution), and restrict file upload access to strictly necessary high-privilege accounts with additional role-based controls. Implement file size limits and consider virus scanning on uploads.

Affected VersionsENISA

Free Hotel Reservation System 1.0

Affected Packages

euvd free_hotel_reservation_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the PHP-based hotel reservation application (cpe:2.3:a:itsourcecode:free_hotel_reservation_system:*:*:*:*:*:*:*:*) within the administrative interface file /admin/mod_amenities/index.php. The root cause is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating insufficient validation of uploaded file types and content. The 'image' parameter accepts file submissions without proper extension whitelisting, MIME type verification, or content inspection before storage. This classic web application flaw allows attackers to bypass client-side or weak server-side validation controls, potentially enabling storage of executable files (.php, .exe, etc.) within the web-accessible directory structure.

Know when Free Hotel Reservation System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

CVE Published

Mar 26, 2026 - 12:23 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /admin/mod_amenities/index.php?view=add. This manipulation of the argument image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Executive ViewAI

Why It Matters

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4875, a unrestricted file upload vulnerability rated CVSS 5.1. This could allow unauthorized file access. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.

Threat Intelligence Overview

EPSS Score

0.0%

Top 90% exploitable

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.