CVE-2026-19210
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/ajax.php?action=save_upload. Manipulation of the img[]/imgName[] arguments leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can upload malicious files to the server, potentially leading to full control of the application or server.
Recommendation
Immediately restrict access to /social/ajax.php and implement validation of file types and sizes. It is also recommended to apply updates or temporary security measures.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.