CVE-2025-4926

CWE-284 — Improper Access ControlCWE-434 — Unrestricted File Upload4 documents4 sources
Severity
5.1MEDIUM
EPSS
0.3%
top 45.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Phpgurukul CAR Rental ProjectPhpgurukul CAR Rental Portal
Timeline
PublishedMay 19

Description

A vulnerability was found in PHPGurukul Car Rental Project 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/post-avehical.php. The manipulation of the argument img1/img2/img3/img4/img5 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
PHPGurukul Car Rental Project post-avehical.php unrestricted upload↗2025-05-19
▶
GHSA
GHSA-g83m-h37w-pr8h: A vulnerability was found in PHPGurukul Car Rental Project 1↗2025-05-19
▶
CVE-2025-4926 (MEDIUM CVSS 5.1) | A vulnerability was found in PHPGur | cvebase.io