CVE-2026-78245

HighCVSS 7.3/10Last modified Oct 12, 2026

Description

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-782467.3A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file succ CVE-2026-782477.3A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /CVE-2026-782487.3A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/ad CVE-2026-782496.8A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 CVE-2026-782504.3A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Wor CVE-2026-782519.3DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload fi CVE-2026-782526.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th CVE-2026-782532.3Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application cras CVE-2026-782547.4The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to CVE-2026-782558.7The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting CVE-2026-782578.8Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782585.3Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.