CVE-2026-117512: oretnom23 php-travel-agency-system employee_insert.php unrestricted upload
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employeeinsert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be performed remotely and requires no privileges or user interaction according to the supplied vector. An attacker able to reach the affected application may be able to submit a crafted employee photo upload.
Is public exploit code available?
Yes. The exploit has been made public, which increases the likelihood of opportunistic exploitation.
Which versions are affected?
The affected version range is not specified in the available information. The vulnerable code is identified as an unknown portion of admin/employee_insert.php.
Is a vendor fix available?
No vendor response or fix is described. The project was notified through an issue report but had not responded at the time of publication.