CVE-2026-9421
KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted upload
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 25, 2026
- Updated
- May 26, 2026
- Reserved
- May 24, 2026
Description
A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of the component File Handler. This manipulation causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
KLiK SocialMediaWebsiten/a |
|
References
- VDB-365402 | KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted uploadvdb-entrytechnical-description
- VDB-365402 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #813725 | SourceCodester SourceCodester KLiK Social Media Website v1.0.1 Unrestricted Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.