CVE-2026-11344: code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload
A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
code-projects Vehicle Management System New Driver Registration Form newdriver.phpfrom your environment.If the photo upload functionality is not required, remove or take newdriver.php offline from the web server to eliminate the vulnerable endpoint.
- Configuration
Disable the photo upload feature in newdriver.php or the application configuration to prevent unrestricted file uploads until a vendor patch is available.
New Driver Registration Form (newdriver.php) photo upload = disabled - Compensating control
Apply network and application-layer controls to mitigate risk: restrict access to the newdriver.php upload endpoint to trusted IPs, and deploy WAF rules to block suspicious upload patterns and executable file types.
- Operational
Inspect logs and uploaded files for evidence of exploitation, remove any malicious files found, and perform incident response if compromise is suspected; continue monitoring the endpoint until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11344?
The severity of CVE-2026-11344 is rated as high with a score of 7.3.
How do I fix CVE-2026-11344?
To fix CVE-2026-11344, implement proper validation and restrictions on file uploads in newdriver.php.
What type of vulnerability is CVE-2026-11344?
CVE-2026-11344 is a Malicious File Upload vulnerability that allows unrestricted file uploads.
Who is affected by CVE-2026-11344?
CVE-2026-11344 affects users of the code-projects Vehicle Management System version 1.0.
Can CVE-2026-11344 be exploited remotely?
Yes, CVE-2026-11344 can be exploited remotely by manipulating the photo argument.