CVE-2026-67688CWE-434unrestricted-file-upload

CVE-2026-67688

Critical · published August 7, 2026

CVSS v3.1

9.8

EPSS

Percentile

58.0

In the wild

Unconfirmed

What it is

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00857 · 58.0th percentile
Weakness: CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2026-08-07T02:18Z

References (3)

https://github.com/qflksheep/CVE-2026-67687-ICS-Park-Smart-Park-Management-System-v2.0/blob/main/CVE-2026-67688 · [email protected]https://github.com/qflksheep/ICS-Park-Smart-Park-Management-System-v2.0-POC/blob/main/xsspoc · [email protected]https://github.com/qflksheep/ICS-Park-Smart-Park-Management-System-v2.0-POC/blob/main/xsspoc · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

06 AUG 00:00Z
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module
cvelistv5