The flaw appears in the save_emp.php script of the Add Employee page and permits an attacker to upload any file type without validation. This unrestricted upload, classed under CWE-284 (Incorrect Authorization) and CWE-434 (Unrestricted Upload of File with Dangerous Type), can be exploited by an attacker who remotely uploads malicious content to the server. While the CVE description states that remote exploitation is possible, it does not explicitly confirm that uploaded files will be executed; the ability to run arbitrary code is inferred based on the nature of the upload and the availability of a published exploit.

SourceCodester Record Management System 1.0 and its equivalent jkev Record Management System 1.0 are affected. The vulnerability resides in the add‑employee module and does not affect other components listed for this release.

The vulnerability has a CVSS score of 5.1, indicating moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The CVE notes that a public exploit exists and that remote exploitation is possible; thus, attackers could send a malicious payload to the vulnerable save_emp.php endpoint over the network. This could lead to remote code execution if the web server or application later processes the file as executable, though such execution is inferred rather than confirmed from the public statement.