CVE-2026-117512
Received
Received - Intake
Unrestricted File Upload in PHP Travel Agency System
Vulnerability report for CVE-2026-117512, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-27
Last updated on: 2026-10-27
Assigner: VulDB
Description
Description
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oretnom23 | php-travel-agency-system | 4e28b8f84d72420373dd15c3ae32900beb7e0635 |
| oretnom23 | php-travel-agency-system | 2592d60d8f2c6e199f02c828c6d6fbc7b5298c96 |
| oretnom23 | php-travel-agency-system | b58513f8371d098650fac656001bf8f59f795d25 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
