CVE-2026-26699
Received Received - Intake
Arbitrary Code Execution in Personnel Property Equipment System

Publication date: 2026-03-02

Last updated on: 2026-03-04

Assigner: MITRE

Description
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-02
Last Modified
2026-03-04
Generated
2026-06-16
AI Q&A
2026-03-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-26699
EUVD
EUVD-2026-9198
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jon-remus-sevellejo personnel_property_equipment_system 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in sourcecodester Personnel Property Equipment System v1.0 exists in the file ip/ppes/admin/admin_change_picture.php, where it allows an attacker to execute arbitrary code on the affected system.

Impact Analysis

This vulnerability can allow an attacker to run arbitrary code on the system, potentially leading to unauthorized access, data theft, system compromise, or disruption of services.

Compliance Impact

I don't know

Detection Guidance

The vulnerability exists in the file ip/ppes/admin/admin_change_picture.php of the sourcecodester Personnel Property Equipment System v1.0, allowing arbitrary code execution.

To detect this vulnerability on your system, you can check for the presence of the vulnerable file and test if it is accessible and exploitable.

  • Use curl or wget to send crafted requests to the admin_change_picture.php endpoint to see if arbitrary code execution is possible.
  • Example command: curl -v --data-binary @exploit_payload.txt http://target-ip/ip/ppes/admin/admin_change_picture.php
  • Check web server logs for suspicious POST requests to admin_change_picture.php.
Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable admin_change_picture.php file.

  • Limit access to the admin directory by IP address or authentication.
  • Apply input validation and sanitization on the admin_change_picture.php script to prevent arbitrary code execution.
  • If possible, remove or disable the vulnerable functionality until a patch is available.
  • Monitor logs for any suspicious activity targeting this endpoint.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart