vulnwire
4.7med

CVE-2026-4875

itsourcecode Free Hotel Reservation System index.php unrestricted upload

Published 7 mo ago · modified 4 mo ago · JSON

CVSS
4.7
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 13%
Public exploits
0
none known

A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /admin/mod_amenities/index.php?view=add. This manipulation of the argument image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction (EPSS)

0.23% probability of exploitation in the next 30 days, higher than 13% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA3.14.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA3.04.7CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA2.05.8AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA4.02.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.14.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CNA2.05.8AV:N/AC:L/Au:M/C:P/I:P/A:P

Affected products

  • itsourcecode Free Hotel Reservation System

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type
  • CWE-284 Improper Access Control

References

  • vuldb.com /?id.353558 · vdb-entry, technical-description
  • vuldb.com /?ctiid.353558 · signature, permissions-required
  • vuldb.com /?submit.776245 · third-party-advisory
  • github.com /bybinyu/Vulnerability-Practice/issues/4 · exploit, issue-tracking
  • itsourcecode.com / · product

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.