This vulnerability in Saad Iqbal User Management allows an attacker with low privileges to upload files without proper restriction on file types. Specifically, it permits uploading web shells, which can be executed on the server, leading to full system compromise. The affected versions include all versions up to and including 1.1. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server, resulting in full compromise of the system's confidentiality, integrity, and availability. This can lead to unauthorized data access, data modification, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict file upload functionality, implement strict server-side validation of uploaded file types, and consider disabling file uploads if not necessary.