CVE-2026-5576

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5576", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-04T14:45:21.680Z", "datePublished": "2026-04-05T15:15:11.335Z", "dateUpdated": "2026-04-06T15:26:32.511Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-05T15:15:11.335Z"}, "title": "SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "Unrestricted Upload"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "SourceCodester", "product": "Record Management System", "versions": [{"version": "1.0", "status": "affected"}], "modules": ["Add Employee Page"]}, {"vendor": "jkev", "product": "Record Management System", "versions": [{"version": "1.0", "status": "affected"}], "modules": ["Add Employee Page"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in SourceCodester/jkev Record Management System 1.0. Affected by this issue is some unknown functionality of the file save_emp.php of the component Add Employee Page. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-04T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-04T16:50:30.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "chenkh (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/355346", "name": "VDB-355346 | SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355346/cti", "name": "VDB-355346 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/783473", "name": "Submit #783473 | jkev Personnel Record Management System V1.0 Unrestricted Upload", "tags": ["third-party-advisory"]}, {"url": "https://github.com/whatyourname12345/CVE/blob/main/PRMS/cve_Arbitrary%20File%20Upload%20to%20RCE.md", "tags": ["exploit"]}], "tags": ["x_freeware"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T15:26:23.458800Z", "id": "CVE-2026-5576", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:26:32.511Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"tags": ["x_freeware"], "title": "SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload", "credits": [{"lang": "en", "type": "reporter", "value": "chenkh (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "SourceCodester", "modules": ["Add Employee Page"], "product": "Record Management System", "versions": [{"status": "affected", "version": "1.0"}]}, {"vendor": "jkev", "modules": ["Add Employee Page"], "product": "Record Management System", "versions": [{"status": "affected", "version": "1.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-04T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-04T16:50:30.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355346", "name": "VDB-355346 | SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355346/cti", "name": "VDB-355346 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/783473", "name": "Submit #783473 | jkev Personnel Record Management System V1.0 Unrestricted Upload", "tags": ["third-party-advisory"]}, {"url": "https://github.com/whatyourname12345/CVE/blob/main/PRMS/cve_Arbitrary%20File%20Upload%20to%20RCE.md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in SourceCodester/jkev Record Management System 1.0. Affected by this issue is some unknown functionality of the file save_emp.php of the component Add Employee Page. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-05T15:15:11.335Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5576", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:26:23.458800Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-06T15:26:28.107Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-5576", "state": "PUBLISHED", "dateUpdated": "2026-04-05T15:15:11.335Z", "dateReserved": "2026-04-04T14:45:21.680Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-05T15:15:11.335Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Add Employee Page"], "product": "Record Management System", "vendor": "SourceCodester", "versions": [{"status": "affected", "version": "1.0"}]}, {"modules": ["Add Employee Page"], "product": "Record Management System", "vendor": "jkev", "versions": [{"status": "affected", "version": "1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in SourceCodester/jkev Record Management System 1.0. Affected by this issue is some unknown functionality of the file save_emp.php of the component Add Employee Page. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en SourceCodester/jkev Record Management System 1.0. Afectada por este problema es alguna funcionalidad desconocida del archivo save_emp.PHP del componente Add Employee Page. Esta manipulaci\u00f3n causa carga sin restricciones. La explotaci\u00f3n remota del ataque es posible. El exploit ha sido publicado y puede ser utilizado."}], "id": "CVE-2026-5576", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5576", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T15:26:23.458800Z", "version": "2.0.3"}}]}, "published": "2026-04-05T16:16:19.123", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/whatyourname12345/CVE/blob/main/PRMS/cve_Arbitrary%20File%20Upload%20to%20RCE.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/783473"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355346"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355346/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Record Management System", "source": "cna", "vendor": "jkev"}, "product": "record_management_system", "vendor": "jkev"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Record Management System", "source": "cna", "vendor": "SourceCodester"}, "product": "record_management_system", "vendor": "sourcecodester"}], "analysis": {"en": {"generated_at": "2026-04-05T18:50:48.211869+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch for SourceCodester Record Management System 1.0 if available", "If no patch exists, configure the upload functionality to allow only approved file types and MIME types", "Disable or remove the vulnerable save_emp.php endpoint if it is not required", "Deploy a web application firewall to block suspicious file upload attempts", "Monitor server logs for anomalous upload activity"], "summary": {"action": "Apply Patch", "impact": "Unrestricted File Upload"}, "threat_synthesis": {"affected_systems": "SourceCodester Record Management System 1.0 and its equivalent jkev Record Management System 1.0 are affected. The vulnerability resides in the add\u2011employee module and does not affect other components listed for this release.", "description_and_impact": "The flaw appears in the save_emp.php script of the Add Employee page and permits an attacker to upload any file type without validation. This unrestricted upload, classed under CWE-284 (Incorrect Authorization) and CWE-434 (Unrestricted Upload of File with Dangerous Type), can be exploited by an attacker who remotely uploads malicious content to the server. While the CVE description states that remote exploitation is possible, it does not explicitly confirm that uploaded files will be executed; the ability to run arbitrary code is inferred based on the nature of the upload and the availability of a published exploit.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.1, indicating moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The CVE notes that a public exploit exists and that remote exploitation is possible; thus, attackers could send a malicious payload to the vulnerable save_emp.php endpoint over the network. This could lead to remote code execution if the web server or application later processes the file as executable, though such execution is inferred rather than confirmed from the public statement."}}}}, "created": "2026-04-06T20:23:14.985970+00:00", "updated": "2026-04-06T21:56:35.453121+00:00", "vendors": ["jkev", "jkev$PRODUCT$record_management_system", "sourcecodester", "sourcecodester$PRODUCT$record_management_system"]}