Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2026-37748: Visitor Management System allows malicious file uploads
CVE-2026-37748 · published 6 months ago
Summary
An attacker with admin access can upload malicious files to the system, potentially allowing them to take control of the server. This could lead to sensitive data being compromised or the system being used to spread malware. Update to a secure version of the software to fix this issue.
Original advisory text
Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without ...
Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remote Code Execution on the server.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.2
High
Type
CWE-434Unrestricted File Upload
Timeline
Published21 Apr 2026
Updated31 Oct 2026
First seen21 Apr 2026
Sources
CVE-2026-37748 · NVD
Track software like this
Free during beta