Critical severity9.8NVD Advisory· Published Nov 10, 2025· Updated Jun 17, 2026

CVE-2021-4462

Description

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Skittles/Employee Records System
cpe:2.3:a:skittles:employee_records_system:1.0:*:*:*:*:*:*:*
Sourcecodester/Employee Records Systemllm-create
Range: 1.0
Employee Records System/Employee Records Systemv5
Range: 1.0

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/49596nvdExploit
www.vulncheck.com/advisories/employees-records-system-arbitrary-file-upload-rcenvdThird Party Advisory
www.sourcecodester.com/php/11393/employee-records-system.htmlnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000