CVE-2021-4462 PUBLISHED

Employee Records System v1.0 Arbitrary File Upload RCE

Assigner: VulnCheck
Reserved: 07.11.2025 Published: 10.11.2025 Updated: 21.11.2025

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Employee Records System
Product	Employee Records System
Versions	Default: unaffected Version 1.0 is affected

Credits

sml finder

References

Problem Types

CWE-434 Unrestricted Upload of File with Dangerous Type CWE

Impacts

CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs