Vulnerability · Published Jan 6, 2026 · Assigned by VulDB
CVE-2026-0643projectworlds House Rental and Property Listing Signup register.php unrestricted upload
High 7.3
In plain English
A high-severity unrestricted file upload in House Rental and Property Listing from projectworlds. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| projectworlds | House Rental and Property Listing | 1.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-339686 | projectworlds House Rental and Property Listing Signup register.php unrestricted upload vdb-entry, technical-description
- VDB-339686 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #732563 | projectworlds.com rental And Property Listing Project V1.0 File unrestricted upload third-party-advisory
- https://github.com/1uzpk/cve/issues/4 exploit, issue-tracking