从网页截图中获取到的关于漏洞的关键信息如下： Title: Employee Records System v1.0 Arbitrary File Upload RCE Severity: Critical Date: November 10, 2025 Affecting: - Employee Records System v1.0 - An affected version range remains undefined CVE: CVE-2021-4462 CWE: CWE-434 Unrestricted Upload of File with Dangerous Type CVSS: 9.3 CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N References: - ExploitDB-49596 - Employee Records System (Sourcecodester) Credit: sml Description: - Employee Records System v1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint. The uploaded files can be executed due to the lack of proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-07 UTC.