CVE-2026-0643

HIGH

Projectworlds House Rental And Proper... - Improper Access Control

Title source: rule

Description

A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

References (4)

Scores

CVSS v3 7.3
EPSS 0.0006
EPSS Percentile 18.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Classification

CWE
CWE-284 CWE-434
Status published

Affected Products (1)

projectworlds/house_rental_and_property_listing_project

Timeline

Published Jan 07, 2026
Tracked Since Feb 18, 2026