CVE-2026-10172
Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 31, 2026
- Updated
- Jun 1, 2026
- Reserved
- May 30, 2026
Description
A security flaw has been discovered in Bdtask Multi-Store Inventory Management System 1.0. The affected element is the function Upload of the file application/modules/dashboard/controllers/Module.php of the component Component Module. The manipulation of the argument module results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Multi-Store Inventory Management SystemBdtask |
|
References
- VDB-367429 | Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted uploadvdb-entrytechnical-description
- VDB-367429 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-10172 | CVE Analysis and Reportthird-party-advisory
- Submit #819418 | Bdtask Multi-Store Inventory Management System 1.0 Code Injectionthird-party-advisory
- https://github.com/kevin57545/CVE/blob/main/bdtask-multi-store-rce.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.