{"id":"CVE-2026-122047","kind":"vulnerability","aliases":["CVE-2026-122047"],"related":[],"title":"Campcodes Loan Management System: unrestricted file upload via banner.php","description":"A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.","summary":"Campcodes Complete Advance Loan Management System 1.0 has an unrestricted file upload in /loan/application/banner.php (image argument). The CVE record says it can be attacked remotely and that the exploit is public; the vector lists no privileges required. No vendor fix is known.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Campcodes Complete Advance Loan Management System","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["campcodes","loan-management-system","other","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Look for /loan/application/banner.php in the web root and confirm the installed version is 1.0. Check the upload directory the script writes to for unexpected .php files. Whether the page needs a login is not stated in any source.","fix":null,"status":"open","published_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:54+00:00","updated_at":"2026-11-05T00:34:01+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T00:31:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Campcodes Loan Management System: unrestricted file upload via banner.php","impact":"high","summary":"Campcodes Complete Advance Loan Management System 1.0 lets anyone upload files through the image argument of banner.php, because the upload is not restricted. An attacker can send a file from the internet without an account and may be able to run code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","loan-management-system","campcodes","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker uploads arbitrary files to the server remotely","analyst_note":"Confirm whether banner.php requires authentication and find a vendor or project fix; the sources give no fixed version or mitigation.","how_to_check":"- Check whether the app has a file at `/loan/application/banner.php`\n- Confirm the installed version is `1.0`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Campcodes Complete Advance Loan Management System 1.0 with the banner upload page reachable. The sources do not say whether a login is required or whether any other version is affected, so treat any instance exposed to the internet as at risk until checked.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4232,"output_tokens":499,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether banner.php requires authentication and find a vendor or project fix; the sources give no fixed version or mitigation.","search":"'-122047':12A,15A '-2026':11A,14A '/loan/application/banner.php':45B,98C '1.0':38B,87C 'advanc':34B,83C 'advance':18A 'affect':89C 'argument':47B,103C 'attack':55B,110C 'banner.php':9A 'campcod':1A,22B,32B,81C 'campcodes':16A 'complet':33B,82C 'complete':17A 'cve':10A,13A,49B 'detect':79C 'disclos':119C 'exploit':60B,116C 'file':6A,42B,94C,97C 'fix':71B 'function':91C 'host':31B 'imag':46B,104C 'known':73B 'launch':113C 'lead':105C 'list':65B 'loan':2A,19A,24B,35B,84C 'loan-management-system':23B 'manag':3A,25B,36B,85C 'management':20A 'manipul':100C 'may':111C,122C 'move':92C 'php':28B 'privileg':67B 'public':62B,120C 'record':50B 'remot':56B,114C 'requir':68B 'say':51B 'secur':75C 'self':30B 'self-host':29B 'system':4A,21A,26B,37B,86C 'unrestrict':5A,41B,107C 'upload':7A,43B,93C,108C 'use':124C 'vector':64B 'vendor':70B 'via':8A 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Campcodes Complete Advance Loan Management System 1.0 with the banner upload page reachable. The sources do not say whether a login is required or whether any other version is affected, so treat any instance exposed to the internet as at risk until checked.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["campcodescompleteadvanceloanmanagementsystem","completeadvanceloanmanagementsystem"],"ptokens":["advance","campcodes","complete","loan","management","system"],"labels":["campcodes","high","loanmanagementsystem","other","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122047","severity":null,"published_at":"2026-11-04T23:17:23+00:00","modified_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122047:1739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122047","severity":null,"published_at":"2026-11-05T00:34:01+00:00","modified_at":"2026-11-05T00:34:01+00:00","first_seen_at":"2026-11-05T00:34:01+00:00","fetched_at":"2026-11-05T00:34:01+00:00","note":"Only NVD/VulDB CNA text found; no vendor advisory, fix, or PoC link located. Mirrors (cvefeed, cve.report) show CWE-284 + CWE-434 but no auth detail. Auth requirement and fix remain unknown; CVSS vector says PR:N. Not independently verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-122047"]}],"documents":[{"id":71620,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122047","title":"NVD CVE-2026-122047 (VulDB CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}