Employee Records System v1.0 Arbitrary File Upload RCE

Advisories

severity: critical
date: November 10, 2025
Affecting: Employee Records System v1.0
An affected version range remains undefined
CVE: CVE-2021-4462
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS: 9.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-49596
Employee Records System (Sourcecodester)
Credit: sml
Description: Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-07 UTC.