CVE-2026-19210
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/ajax.php?action=save_upload. Manipulation of the img[]/imgName[] arguments leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can upload malicious files to the server, potentially leading to full control of the application or server.
Recommendation
Immediately restrict access to /social/ajax.php and implement validation of file types and sizes. It is also recommended to apply updates or temporary security measures.
Other vulnerabilities in SourceCodester Photo Share Website
See all- CVE-2026-19230Low
A vulnerability in SourceCodester Photo Share Website 1.0 affects an unknown part of the file /social/ajax.php?action=save_upload of the Comment Input Box component. Manipulation of the content argument leads to cross site scripting. The attack may be initiated remotely, and the exploit is publicly available.
- CVE-2026-19211High
A vulnerability was found in SourceCodester Photo Share Website 1.0. It affects an unknown function in the file /social/ajax.php?action=signup. Manipulation of the email argument results in SQL injection. Remote exploitation is possible. The exploit has been made public and could be used.
- CVE-2026-19209Low
A cross-site scripting vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/index.php?page=home. Manipulation of the Comment argument causes XSS. The attack can be initiated remotely and the exploit is public.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS