CVE-2026-7132
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. The readfile function in /download.php allows path traversal via manipulation of the File argument. The attack can be initiated remotely and the exploit has been made public.
Risk Assessment
A remote attacker could exploit path traversal to read files outside the intended directory, potentially leading to leakage of sensitive data, including configuration files. The risk affects Online Lot Reservation System deployments at version 1.0 and earlier.
Recommendation
Update the system to the latest available version or implement validation of the File argument and restrict filesystem access. Monitor traffic to /download.php for path traversal attempts.
Other vulnerabilities in Online Lot Reservation System
See all- CVE-2026-7134Medium
A vulnerability was identified in code-projects Online Lot Reservation System 1.0 affecting an unknown function of /edithousepic.php. Manipulation of the image argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-7133Medium
A vulnerability was determined in code-projects Online Lot Reservation System 1.0 affecting an unknown function of /activity.php. Manipulation of the directory argument causes unrestricted upload. The attack can be initiated remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS