Critical severity · published Jan 7, 2026
CVE-2026-0643
A flaw has been found in projectworlds House Rental and Property Listing 1.0
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
House Rental And Property Listing Project · Projectworlds
1.0 · source: NVD
Affected product
HR
House Rental And Property Listing Project
Projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0643
Exploit
https://github.com/1uzpk/cve/issues/4
Permissions Required
https://vuldb.com/?ctiid.339686
Third Party Advisory
https://vuldb.com/?id.339686
Third Party Advisory
https://vuldb.com/?submit.732563
More from House Rental And Property Listing Project
9.8
CVE-2020-24202
File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allows remote attackers to conduct code…
6.1
CVE-2026-0642
A vulnerability was detected in projectworlds House Rental and Property Listing 1.0
5.4
CVE-2026-1700
projectworlds House Rental and Property Listing sms.php cross site scripting