EIP-2026-113317

This exploit demonstrates an arbitrary file upload vulnerability in Webiness Inventory 2.9, allowing an attacker to upload a malicious PHP file to achieve remote code execution (RCE). The vulnerability lies in the lack of file type validation in the WsSaveToModel.php script.