The Vulnerability allows an attacker to supply crafted input to the PHP script that handles image uploads in the admin change picture page, leading to arbitrary code execution on the server. The flaw is a classic code injection issue (CWE-94). An attacker who can trigger the upload function could run commands with the privileges of the web application process, compromising confidentiality, integrity, and availability of the entire system.

Personnel Property Equipment System version 1.0, released by the vendor identified in the CPE as jon-remus-sevellejo. No other versions or products are listed as affected.

The CVSS score of 7.2 indicates a high severity; however, the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Externally accessible, the impacted endpoint accepts HTTP requests, so a remote attacker reasonably could exploit the flaw by sending a specially crafted file upload to the admin_change_picture.php endpoint, provided the attacker has network access to the application.