CVE-2026-37748

Visitor Management System version 1.0 by sanjay1313 contains an unrestricted file upload vulnerability in the admin_user_insert.php and update_1.php files. The application fails to validate uploaded files by MIME type, extension, or content, allowing authenticated administrators to upload malicious PHP webshells and execute arbitrary code on the server. The vulnerability has a CVSS score of 7.2 (HIGH) with a network attack vector and low complexity. While exploitation requires high-level admin privileges, successful attacks can result in complete system compromise, including confidentiality, integrity, and availability impacts. The EPSS score of 0.00074 indicates this threat currently ranks below average in real-world exploitation likelihood. There is no evidence of active exploitation in the wild, no public exploit code readily available, and minimal community attention to this vulnerability. The absence of the CVE from the CISA Known Exploited Vulnerabilities catalog and its inactive status on vulnerability tracking hotlists suggest limited practical threat at this time. Organizations should nonetheless prioritize patching if this product is deployed in their environment.