Critical severity · published Jan 6, 2026
CVE-2026-0643
projectworlds House Rental and Property Listing Signup register.php unrestricted upload
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
House Rental and Property Listing · projectworlds
1.0 · source: vendor
HR
House Rental And Property Listing Project · Projectworlds
1.0 · source: NVD
Affected product
HR
House Rental and Property Listing
projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0643
Exploit
https://github.com/1uzpk/cve/issues/4
Permissions Required
https://vuldb.com/?ctiid.339686
Third Party Advisory
https://vuldb.com/?id.339686
Third Party Advisory
https://vuldb.com/?submit.732563
More from House Rental and Property Listing
9.8
CVE-2023-3694
SourceCodester/projectworlds House Rental and Property Listing index.php sql injection
6.1
CVE-2026-0642
projectworlds House Rental and Property Listing complaint.php cross site scripting
5.4
CVE-2026-1700
projectworlds House Rental and Property Listing sms.php cross site scripting