CAMPCODES COMPLETE ADVANCE LOAN MANAGEMENT SYSTEM · CVE-2026-122047 · Other
NO FIX YET
Campcodes Complete Advance Loan Management System 1.0 has an unrestricted file upload in /loan/application/banner.php (image argument). The CVE record says it can be attacked remotely and that the exploit is public; the vector lists no privileges required. No vendor fix is known.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Campcodes Complete Advance Loan Management System 1.0 with the banner upload page reachable. The sources do not say whether a login is required or whether any other version is affected, so treat any instance exposed to the internet as at risk until checked.
Not affected if unknown
Who cares campcodes, loan-management-system, php, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.