Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remote Code Execution on the server.
References
| Link | Resource |
|---|---|
| https://github.com/menevarad007/CVE-2026-37748 | Exploit Third Party Advisory |
| https://github.com/sanjay1313/Visitor-Management-System | Product |
| https://github.com/menevarad007/CVE-2026-37748 | Exploit Third Party Advisory |
Configurations
History
22 Apr 2026, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sanjay1313:visitor_management_system:1.0:*:*:*:*:*:*:* | |
| First Time |
Sanjay1313 visitor Management System
Sanjay1313 |
|
| References | () https://github.com/menevarad007/CVE-2026-37748 - Exploit, Third Party Advisory | |
| References | () https://github.com/sanjay1313/Visitor-Management-System - Product |
21 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| References | () https://github.com/menevarad007/CVE-2026-37748 - | |
| CWE | CWE-434 |
21 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-21 16:16
Updated : 2026-04-22 16:02
NVD link : CVE-2026-37748
Mitre link : CVE-2026-37748
CVE.ORG link : CVE-2026-37748
JSON object : View
Products Affected
sanjay1313
- visitor_management_system
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type