This vulnerability affects code-projects Vehicle Management System 1.0, specifically the newdriver.php file used in the New Driver Registration Form component. The issue arises from insufficient validation or restriction on the 'photo' argument, allowing an attacker to perform unrestricted file uploads. This can be exploited remotely without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system. This could lead to unauthorized file storage, potential execution of malicious code, or other impacts depending on the server configuration and file handling. The CVSS score of 6.9 reflects a medium severity level, indicating a significant but not critical risk. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict file upload functionality, implement strict validation and sanitization of uploaded files, and monitor for suspicious upload activity. Avoid exposing the vulnerable component to untrusted users if possible.