CVE-2026-4875CWE-284CWE-434

itsourcecode Free Hotel Reservation System index.php unrestricted upload

Medium · published March 26, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /admin/mod_amenities/index.php?view=add. This manipulation of the argument image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00376 · 30.2th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-26T12:23Z
EPSS history
Timeline
  • 26 MAR 12:23Z
    itsourcecode Free Hotel Reservation System index.php unrestricted upload
    cvelistv5