The vulnerability resides in the request_blood.php component of the BloodBank Managing System. It permits an attacker to upload files without any restriction on file type or size, enabling the placement of potentially executable content on the server. The upload function can be invoked remotely, and the exploit has already been published online, implying a realistic threat of executing arbitrary code or planting malicious web content.

The affected product is code‑projects BloodBank Managing System, version 1.0. No other versions or products are listed as impacted.

The CVSS score of 5.3 places the issue in the medium severity band. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Because the flaw allows unrestricted upload from remote users, the attack vector is inferred to be remote exploitation, with a moderate likelihood of successful compromise if no patch is applied.