CVE-2025-4926 MEDIUM

CVE-2025-4926: PHPGurukul Car Rental Project post-avehical.php unrestricted upload

Vendor Phpgurukul
Product Car Rental Project
Weakness CWE-434 · Unrestricted file upload
Published May 19, 2025
Last update May 19, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in PHPGurukul Car Rental Project 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/post-avehical.php. The manipulation of the argument img1/img2/img3/img4/img5 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

May 19, 2025 CVE published
May 19, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-4923 SourceCodester Client Database Management System user_delivery_update.php unrestricted upload CVE-2021-34624 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component CVE-2026-2942 ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess CVE-2023-53871 Soosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic CVE-2026-48283 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)