CVE-2025-66802

Critical

Published: 12/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Remote Code Execution (RCE) vulnerability in Sourcecodester Covid-19 Contact Tracing System 1.0. The application accepts a reverse shell (php) into the user's image, enabling RCE.

Risk Assessment

An attacker can gain full control of the server, leading to confidentiality, integrity, and availability breaches.

Recommendation

Update the system or apply security patches, and restrict file upload capabilities.

Original NVD description (English source)

Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receives a reverse shell (php) into imagem of the user enabling RCE.