KLiK SocialMediaWebsite CVE-2026-9421

Q: What is the CVSS score of CVE-2026-9421?

CVE-2026-9421 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31624 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-25 VulDB

GHSA-fhgp-q8x3-7fx5

PHP File Upload Klik Socialmediawebsite

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:42 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of the component File Handler. This manipulation causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Unrestricted file upload in KLiK SocialMediaWebsite 1.0 exposes the application to unauthenticated remote exploitation via the uniqid function in upload.inc.php. The File Handler component fails to validate uploaded file types (CWE-434), allowing an attacker to upload PHP webshells or other executable files without any authentication - confirmed by the CVSS 4.0 vector PR:N/UI:N. Exploit code has been publicly disclosed (CVSS E:P, referenced via VulDB), though EPSS remains low at 0.04% and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

KLiK SocialMediaWebsite is a PHP-based social media web application. The vulnerable component is upload.inc.php, specifically the uniqid() PHP function used in the File Handler. The uniqid() function generates a unique timestamp-based identifier for uploaded filenames but performs no MIME-type inspection, file extension whitelisting, or magic-byte validation. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) pattern: the filename uniqueness mechanism is conflated with file safety enforcement, leaving a gap that allows PHP scripts or other server-executable types to be stored. The CPE identifier cpe:2.3:a:n/a:klik_socialmediawebsite:*:*:*:*:*:*:*:* uses 'n/a' for the vendor field, indicating NVD has not assigned a formal vendor entry, which is consistent with a small community or open-source project with limited maintained release history.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CPE vendor field is 'n/a,' consistent with an unmaintained or community project, and no patch version appears in any referenced advisory. Operators should immediately apply the following compensating controls: restrict or disable the file upload endpoint in upload.inc.php if the feature is not required; configure the web server to deny PHP execution in upload directories (e.g., add php_flag engine off in an Apache .htaccess file for upload paths, or equivalent Nginx location block); implement server-side MIME-type and file extension validation to reject executable types (php, phtml, php3, etc.) before storage; and restrict file upload functionality to authenticated sessions if business requirements permit. Monitor upload directories for newly created executable files as a detection control. Note: disabling PHP execution in upload directories prevents RCE escalation but does not fix the underlying unrestricted upload issue - malicious files may still be stored. Refer to https://nvd.nist.gov/vuln/detail/CVE-2026-9421 and https://vuldb.com/vuln/365402 for updates on patch availability.