Is there a public PoC exploit available for CVE-2026-7133?

Yes, a public proof-of-concept exploit is available for CVE-2026-7133. Prioritise patching immediately. EPSS: 0.0%.

Online Lot Reservation System CVE-2026-7133

Q: What is the CVSS score of CVE-2026-7133?

CVE-2026-7133 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25861 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-27 VulDB

PHP File Upload Online Lot Reservation System Code Projects

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-reachable endpoint but high-privilege authentication required (PR:H); limited C/I/A as upload alone does not guarantee full system compromise without additional steps.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:57 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 15:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 15:00 euvd

EUVD-2026-25861

CVE Published

Apr 27, 2026 - 14:45 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was determined in code-projects Online Lot Reservation System 1.0. This impacts an unknown function of the file /activity.php. This manipulation of the argument directory causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Unrestricted file upload in code-projects Online Lot Reservation System 1.0 exposes the /activity.php endpoint to arbitrary file upload via the directory argument, enabling authenticated attackers to plant PHP webshells on the server. The CVSS 4.0 vector assigns PR:H, meaning exploitation is gated behind high-privilege administrative credentials - substantially narrowing the attack surface despite remote reachability. A public proof-of-concept is available on GitHub, but no confirmed active exploitation (CISA KEV) has been identified, and an EPSS of 0.03% signals very low opportunistic exploitation probability.

Technical ContextAI

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) within a PHP-based web application. The endpoint /activity.php processes a user-supplied directory argument to determine where an uploaded file is written, without enforcing file type, extension, or content validation. In PHP environments, this class of flaw is classically exploited by uploading a .php webshell to a web-accessible directory, after which the attacker issues an HTTP GET request to the uploaded file to achieve server-side code execution. The affected product is identified by CPE cpe:2.3:a:code-projects:online_lot_reservation_system:*:*:*:*:*:*:*:*, and the ENISA EUVD entry EUVD-2026-25861 confirms version 1.0 as the affected release. Tags indicate a PHP stack, consistent with the CWE-434 exploitation path.

RemediationAI

No vendor-released patch has been identified at time of analysis for code-projects Online Lot Reservation System 1.0. As a primary compensating control, the upload functionality in /activity.php should be restricted server-side to enforce a whitelist of permitted file extensions (e.g., images only) and validate MIME type against actual file content - this directly addresses CWE-434 at the application layer. If immediate code changes are not possible, configure the web server (Apache .htaccess or nginx location block) to deny execution of PHP and other server-side script types in the upload destination directory; note this adds configuration complexity and must be applied to every upload path. Web application firewall rules blocking upload of .php, .phtml, .phar, and similar extensions to /activity.php provide an additional layer, though they may be bypassed via double extensions if not carefully tuned. Access to the administrative interface housing this endpoint should be restricted by IP allowlist where operationally feasible. The public exploit reference at https://github.com/zzk6th/cve/issues/3 can be used to validate whether implemented mitigations are effective. VulDB advisory: https://vuldb.com/vuln/359732.