Security readout for executives and security teams
Plain-English summary
CVE-2026-0643 affects projectworlds House Rental and Property Listing 1.0. The signup image upload can accept files without proper restriction, allowing remote unauthenticated abuse. Public exploit material is referenced, but no source confirms active exploitation. Systems exposing this application to the internet should be treated as high priority.
Executive priority
Prioritize externally exposed deployments because exploitation is remote, unauthenticated, and public exploit information exists. If this software supports a public website, reduce exposure immediately while seeking vendor guidance.
Technical view
The issue is an unrestricted file upload in /app/register.php?action=reg in the Signup component, involving the image argument. The CVE maps to CWE-434 and CWE-284, with CVSS 2.0 score 7.5. Remote exploitation is possible without authentication according to the supplied record. A public GitHub issue is referenced as exploit-related.
Likely exposure
Exposure is likely limited to organizations running projectworlds House Rental and Property Listing version 1.0, especially if the signup page is internet-accessible. The source bundle does not identify other affected versions or products.
Exploitation context
The sources state the exploit has been published and may be used. CISA KEV status is false in the provided data, and no cited source confirms active exploitation in the wild.
Researcher notes
Evidence is sparse and largely from VulDB/CVE metadata. The vulnerable function is unspecified. No patch, fixed version, or vendor advisory is named in the provided sources. Avoid assuming impact beyond version 1.0 and the signup image upload path.
Mitigation direction
- Inventory for projectworlds House Rental and Property Listing 1.0 deployments.
- Check projectworlds or application maintainer guidance for an official fix.
- Restrict public access to the signup route where business use allows.
- Disable or tightly control image upload functionality until fixed.
- Monitor upload directories and web logs for unexpected files.
Validation and detection
- Confirm whether version 1.0 is deployed in any environment.
- Determine whether /app/register.php?action=reg is externally reachable.
- Review application configuration for signup and image upload exposure.
- Inspect recent uploads for unexpected file types or server-executable content.
- Check vendor and CVE sources for updated remediation guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0643 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR106.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
7.5HighVector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-339686 | projectworlds House Rental and Property Listing Signup register.php unrestricted uploadCVE reference · vdb-entry, technical-description
- VDB-339686 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #732563 | projectworlds.com rental And Property Listing Project V1.0 File unrestricted uploadCVE reference · third-party-advisory
- https://github.com/1uzpk/cve/issues/4CVE reference · exploit, issue-tracking
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.