Description
A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_query.php. The manipulation of the argument per_file results in unrestricted upload. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| code-projects | Employee Profile Management System | 1.0 | — |
References
- VDB-334615 | code-projects Employee Profile Management System add_file_query.php unrestricted upload vdb-entry technical-description
- VDB-334615 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #699247 | code-projects Employee Profile Management System published November 15, 2025 Unrestricted Upload third-party-advisory
- https://github.com/shenxianyuguitian/employee-management-UFU exploit
- https://code-projects.org/ product