CVE-2021-4462 Employee Records System v1.0 Arbitrary File Upload RCE
Remote unauthenticated attackers can upload arbitrary files to execute code due to missing server-side validation in the upload endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-4462?
CVE-2021-4462 is a critical vulnerability in Employee Records System, published on 10 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Weakness: CWE-434
Which versions are affected by CVE-2021-4462?
It affects 1 product.
Products include Skittles Employee Records System.
How do I fix CVE-2021-4462?
No fix has been published for CVE-2021-4462 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-4462 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-4462 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-cm35-q368-98g3.