Live › vulnerability › CVE-2026-117512
Go to dashboardThe admin employee insert page in oretnom23's php-travel-agency-system accepts an employee photo upload without restricting the file type. A remote attacker can upload arbitrary files, which can lead to running code on the server if the uploaded file is executed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Sites running oretnom23's php-travel-agency-system with the admin employee insert page reachable. The sources do not say which versions are fixed, and the project has not responded to the report. Teams that do not use this project can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| php-travel-agency-system | github | unknown (no version range published) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-117512")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.