Is there a public PoC exploit available for EUVD-2026-54511?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54511. Prioritise patching immediately. EPSS: 0.3%.

Photo Share Website EUVD-2026-54511

Q: What is the CVSS score of EUVD-2026-54511?

EUVD-2026-54511 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19210 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-07 VulDB

GHSA-wqwv-2j54-cp38

PHP File Upload Photo Share Website Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable endpoint, low-privilege auth required, no interaction needed; scope change reflects OS-level RCE potential when PHP executes uploaded webshell.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 16:31 vuln.today

Severity Changed

Aug 07, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Aug 07, 2026 - 16:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Aug 07, 2026 - 16:00 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is SourceCodester Photo Share Website 1.0, a PHP-based social photo-sharing web application (CPE: cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:*). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the AJAX handler at /social/ajax.php fails to validate the MIME type, extension, or content of files submitted through the img[] and imgName[] parameters before writing them to disk. In PHP environments, an attacker can upload a .php file containing arbitrary server-side code; if the destination path is web-accessible and PHP execution is not disabled by the server configuration, the uploaded file can be retrieved via a direct HTTP request to trigger execution with the privileges of the web server process.

RemediationAI

No vendor-released patch has been identified at the time of analysis; the SourceCodester product page (https://www.sourcecodester.com/) should be monitored for updates. As immediate compensating controls: restrict accepted file types in the upload handler to an explicit allowlist of safe extensions (.jpg, .jpeg, .png, .gif) and validate both MIME type and file magic bytes server-side - not just the client-supplied filename in imgName[]. Store uploaded files outside the web root or in a dedicated directory with PHP execution explicitly disabled (Apache: php_flag engine off in .htaccess or Options -ExecCGI; Nginx: fastcgi_pass removed for the upload path). Rename all uploaded files to randomly generated non-executable names upon receipt. Apply file permissions (chmod 644) to stored uploads to prevent execution. Disabling the upload feature entirely (removing or restricting /social/ajax.php) is the lowest-risk mitigation if the feature is non-essential. The public PoC at https://github.com/gensnext/cve/issues/2 provides technical detail to inform testing of controls.