CVE-2021-44087
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
A Remote Code Execution (RCE) vulnerability in Sourcecodester Attendance and Payroll System v1.0 allows an unauthenticated remote attacker to upload a malicious PHP file via the photo upload functionality.
Risk Assessment
An attacker can gain full control over the server, steal data, or install malware, posing a critical threat to the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update the system to the latest version or apply a security patch, and implement file type validation and upload restrictions on the server.
Original NVD description (English source)
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remote attacker to upload a maliciously crafted PHP via photo upload.