The vulnerability involves an unrestricted file upload endpoint in the prod.php script of the Online Product Reservation System 1.0. An attacker may upload arbitrary files without restriction, potentially including executable or web‑shell payloads. Based on the description, the upload functionality can be accessed remotely, so an attacker could trigger the upload from an external network. However, the CVE description does not explicitly state that uploaded files are executed, so the potential for remote code execution remains an inferred possibility rather than a documented outcome.

The affected product is code-projects Online Product Reservation System version 1.0. The corresponding CPE identifier fabian:online_product_reservation_system:1.0 confirms the specific build at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the public exploit and remote nature of the upload endpoint suggest that a determined attacker could leverage this flaw, especially if the application is exposed to untrusted users.