PT-2026-45176 · Unknown · Bdtask Multi-Store Inventory Management System

Kevin57545 · Published 2026-05-31 · Updated 2026-05-31 · CVE-2026-10172

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bdtask Multi-Store Inventory Management System version 1.0

Description An unrestricted file upload flaw exists in the Component Module. A remote attacker can manipulate the module argument within the Upload() function of the file application/modules/dashboard/controllers/Module.php to upload arbitrary files.

Recommendations Update Bdtask Multi-Store Inventory Management System to a version newer than 1.0. As a temporary workaround, restrict access to the Upload() function in application/modules/dashboard/controllers/Module.php or avoid using the module argument until a patch is applied.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2026-10172

Affected Products

Bdtask Multi-Store Inventory Management System

References · 7

• 🔥 https://github.com/kevin57545/CVE/blob/main/bdtask-multi-store-rce.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10172 · Security Note
• https://vuldb.com/cve/CVE-2026-10172 · Note
• https://vuldb.com/vuln/367429 · Note
• https://vuldb.com/vuln/367429/cti · Note
• https://twitter.com/VulmonFeeds/status/2061006852318449675 · Twitter Post
• https://vuldb.com/submit/819418 · Note