A flaw in the signup process of Projectworlds House Rental and Property Listing allows an attacker to upload arbitrary files without any restriction. Because the uploaded files can be executed, an attacker could execute malicious scripts or binaries on the server, leading to full control of the application or server. The weakness is identified as lack of proper access control and unrestricted file upload, exposing the system to potential remote code execution.

The vulnerability exists in Projectworlds House Rental and Property Listing version 1.0, specifically in the register.php script when the action parameter is set to reg as part of the Signup component. No other products or versions are noted as affected.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the flaw involves a publicly accessible file upload endpoint, and an attacker could run the upload without needing local system access.