CVE-2022-4276: House Rental System POST Request tenant-engine.php unrestricted upload

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-03 · updated 2026-06-17
Weakness: CWE-266

Description

A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214772.

Affected products

House Rental System: all versions

References

https://github.com/nikeshtiwari1/House-Rental-System/issues/8
https://vuldb.com/?id.214772
https://github.com/nikeshtiwari1/House-Rental-System/issues/8
https://vuldb.com/?id.214772

Get alerted when CVE-2022-4276 or the next vulnerability affects your stack