code-projects Invoice System CVE-2026-7107

Q: What is the CVSS score of CVE-2026-7107?

CVE-2026-7107 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25804 LOW

Improper Access Control (CWE-284)

2026-04-27 cna@vuldb.com

Authentication Bypass File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Apr 27, 2026 - 09:31 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 09:22 euvd

EUVD-2026-25804

Analysis Generated

Apr 27, 2026 - 09:22 vuln.today

CVE Published

Apr 27, 2026 - 09:16 nvd

LOW 2.1

DescriptionCVE.org

A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Unrestricted file upload in code-projects Invoice System Laravel 1.0 allows authenticated attackers to upload arbitrary files via the logo parameter in the /company endpoint, enabling remote code execution or malicious file distribution. Public exploit code is available, and the vulnerability requires only low-privilege authenticated access with no user interaction.

Technical ContextAI

The vulnerability exists in a Laravel-based invoice management system where file upload functionality lacks proper validation on the logo parameter within the /company endpoint. CWE-284 (Improper Access Control) indicates insufficient authorization checks or validation logic governing file upload operations. The affected product uses Laravel framework (1.0 version), which provides built-in file handling mechanisms that appear to be misconfigured or bypassed in this implementation. The unrestricted upload capability suggests missing file type validation, size restrictions, or storage path sanitization, allowing attackers to write arbitrary files to the web-accessible directory or elsewhere on the server.

RemediationAI

Apply vendor security patch when available; contact code-projects for official guidance at https://code-projects.org/. Immediate workaround: restrict access to the /company endpoint via web application firewall (WAF) or authentication layer to block low-privilege users until patching is feasible. Implement strict file upload validation at the application level: whitelist allowed MIME types (e.g., only image/jpeg, image/png), enforce file size limits (e.g., max 5MB), and store uploads outside the web root or in a non-executable directory with .htaccess/.web.config denying script execution. Rename uploaded files to random identifiers and strip metadata to prevent execution vectors. Monitor /company endpoint access logs for suspicious upload patterns. If the Laravel application runs with file execution permissions in the upload directory, reconfigure directory permissions to remove execute bits (chmod 644) and disable PHP script execution in that directory via web server configuration.