CVE-2026-37748

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remote Code Execution on the server.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Apr 21, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-377499.8A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authen CVE-2026-37757.8The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories wri CVE-2026-377506.1A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to ex CVE-2026-377519.8An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac CVE-2026-37765.5The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF cont CVE-2026-37777.8The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document z CVE-2026-37785.5The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations a CVE-2026-37797.8The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which CVE-2026-37807.8The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can inc CVE-2026-37815.4The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and includi CVE-2026-37835.3When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that tok CVE-2026-37846.5curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for