BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-24

Assigner: VulnCheck

Description

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2025-11-24

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2021-4462

Affected Vendors & Products

Vendor	Product	Version / Range
skittles	employee_records_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an unrestricted file upload issue in Employee Records System version 1.0. It allows a remote unauthenticated attacker to upload arbitrary files through the uploadID.php endpoint. Because the application does not properly validate files on the server side, the attacker can upload files that can be executed on the server, potentially leading to further compromise.

Impact Analysis

The vulnerability can allow attackers to execute arbitrary code on the server by uploading malicious files. This can lead to unauthorized access, data theft, data manipulation, service disruption, or complete system compromise.

Hi! I’m here to help you understand CVE-2021-4462. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70