CVE-2026-0643

HIGH

Projectworlds House Rental And Proper... - Improper Access Control

Title source: rule
STIX 2.1

Description

A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

References (4)

Scores

CVSS v3 7.3
EPSS 0.0006
EPSS Percentile 19.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-284 CWE-434
Status published
Products (1)
projectworlds/house_rental_and_property_listing_project 1.0
Published Jan 07, 2026
Tracked Since Feb 18, 2026