Vulnerability details

CVE-2026-56124

shimosyan phpUploader

phpUploader < 2.0.2 Unauthenticated Database Exposure via index model

CVSS 4.0

8.7High

Official description

phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`
7.5High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected products

Vendor	Product	Versions	Source
shimosyan	phpUploader	v < 2.0.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/shimosyan/phpUploader/releases/tag/v2.0.2 release-notes
https://github.com/shimosyan/phpUploader/pull/294 issue-trackingpatch
https://github.com/shimosyan/phpUploader/commit/45dc4f1c9a2de5ade427deebad0148834c0e8c50 patch
https://www.vulncheck.com/advisories/phpuploader-unauthenticated-database-exposure-via-index-model third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-29
Last updated: 2026-11-08
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.63%

Probability of exploitation in 30 days

50.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere